Extracted

• • Target

    0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d

  • Size

    172KB

  • MD5

    1f4e7c20dadac75a754a845fd13b8355

  • SHA1

    fe2c86047f92645b90ef85a244d61b504ce7f78f

  • SHA256

    0a6b024411bfb27075b4e3e4378db98fa004c6920003c376018eace74dcf282d

  • SHA512

    0148dfa3551d2d0d50b8faa6d7ab5aacbc4222b6572cc9ecca1b4346759ffe818282a30d942579378d18a2b4ebc6d347c01ee9f2005c96e5934562e79e3431dd

  • SSDEEP

    3072:RQIyRTXJFnw+Iis1W6NsN7GsHa1Tlg06R3SGQf5Lf56fl/g+j58C:RqrM1Y3Ha9KxoNfTUaC

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2