Extracted

• • Target

    5dba083ebada740c1c32255a29a9203028616f46d6f2086b2794cfea247a9bbd

  • Size

    194KB

  • MD5

    443d7ec8d23a74095cfe559a0a4d50ee

  • SHA1

    db2660259f2956115e7ffbba47b0895f55528f65

  • SHA256

    5dba083ebada740c1c32255a29a9203028616f46d6f2086b2794cfea247a9bbd

  • SHA512

    6d52b8bcd63078d3cc643c0949ba7bb050051c57c3e6cdd18cc75728256b1e525c1596113713dafc26056ae5627718f734459c901a3a7dc222399544fd2a0832

  • SSDEEP

    3072:S8YNQKPWDyHRe9VJltZrpRl1P3220TITAk1i7jQmTnLN+YPGvpAPEdSafQU4F:4NSDyHR41thpvck1iYmjLIoEdZQU4

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2