Extracted

• • Target

    9bce05f6b567ce1fb30cf43cce0512ade016be423b57126e44a3398867dd066a

  • Size

    405KB

  • MD5

    1e46827a559fc62e9b26d2e8bdff23b4

  • SHA1

    e15f1d2577bd3ce52bea90569579ca51824a4b1e

  • SHA256

    9bce05f6b567ce1fb30cf43cce0512ade016be423b57126e44a3398867dd066a

  • SHA512

    13ea7e5d01fc4d5ea0336c4cff1180b4b8e0160f341e2d2257504a08b142e7aaa65b25bb9c1f8e3d5b696b3ab26747dde9a607b4630e6d4caab3d9e438cfd441

  • SSDEEP

    3072:vch1NS7O+b86PcvgKOEtIG7QYkBt6+H3rdS2r2Cbp:0nNWO+bfPcvgKVmBt62Vp

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2