Extracted

• • Target

    dff365a9f7ae445ee8fe27294d2bb0d6301cd0173b7fc1fb7d3bf7aab519b738

  • Size

    124KB

  • MD5

    03d7e73739020df60ebd84743a9f7e80

  • SHA1

    b8b0c91c121529dc5685d2ebecd43f64472169f5

  • SHA256

    dff365a9f7ae445ee8fe27294d2bb0d6301cd0173b7fc1fb7d3bf7aab519b738

  • SHA512

    1fd54fcc752a9dc28a28b38300eee64092ac272e862320402df80c6f77ea09ea9ae44f69553a6636178f63d1e94822ad5c0e7b86aa4d2c68b437867248005201

  • SSDEEP

    1536:tituLieZvGvscwXo6PJFm4/jXF9FQ4fQw87n26l8bVkZHMxKQKlG0CpOo1fumwMW:ti2XcQo6PNfP87n289sIw0CVuAQKanhR

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2