Extracted

• • Target

    6b301332f8bf4cf574a851964190b0683e96fc3ebbc170e4f1cda2cdd9efff37

  • Size

    740KB

  • MD5

    9396aab89011f23a75961f549738ad80

  • SHA1

    62b7d11aad93f38af509ad90df83c470cd6d9588

  • SHA256

    6b301332f8bf4cf574a851964190b0683e96fc3ebbc170e4f1cda2cdd9efff37

  • SHA512

    32b002858bdb4405cc735a2dbbf8f5f384ec9aa89019f080cf087fe5805e527bed60f979481c401e196ee1338a3ecbdcbe2a66d5837ddd9a324575e67458df44

  • SSDEEP

    12288:iWaCZzzSNvb46hDBWz6bNPPhO3NBNRUyCvenAVUIl/WB4h6c/BfFYwXALktk/8lj:oR2BNR6xk/8QsrpfyM

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2