Extracted

• • Target

    b0e66fe0747634ee6474092077e2c39a9e6e4e434720b415c556348f92293b39

  • Size

    243KB

  • MD5

    349b0d1a3449939d4f8e778aa5af881d

  • SHA1

    da1ae6474d6b6526449a3352307baae6b8050f7c

  • SHA256

    b0e66fe0747634ee6474092077e2c39a9e6e4e434720b415c556348f92293b39

  • SHA512

    c5c43c210dda96e4963d3f8eff8239addd72fbc8f760fbc636620eebad3c4d05311828a5b6f2ec3ad45864e3557bd84674393c8067a00f343251779dc44e3f1f

  • SSDEEP

    3072:3YgJesFiglPZ1yxyvZcMO/6T4nIB5B35c8aObB34vP8+bVNkfcYaMfs9E3hzlep:V5FplxAAZcR/6TkINJLxF3iNocsk01A

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2