Extracted

• • Target

    61009638222ff2aa8e0f63463099f5eb25029bb8558580e50ef8f6205983357a

  • Size

    151KB

  • MD5

    3b7f7a31a6c74457ba2c5eef3656a8b0

  • SHA1

    faac2aa94ef82236c56c4b6d315ce7c6bce3afb9

  • SHA256

    61009638222ff2aa8e0f63463099f5eb25029bb8558580e50ef8f6205983357a

  • SHA512

    a31dc305ee5d7b002188004eef9d9b6ca5c62c465070900659dd18390f40e2f5d0fe7c35305257d1283dc7f4a26108e2702e87eba394e7204257d099586a395c

  • SSDEEP

    3072:OgXdZW9P6D3XJ3UYRD66YbIL3246Wm0IDFQodwmMRUVvuQ/1DOOd:Oek4dUaD6rMLAIEF5hMRUVmuEM

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2