Extracted

• • Target

    9ca07f9a225e9217c9715e616eca757d0c2a01b398554d036cec5ab75276ebe9

  • Size

    268KB

  • MD5

    6fbea70a9cfd7766c85a765fcf05a3cf

  • SHA1

    179db87306862005d5b13983c2fc1da86824660c

  • SHA256

    9ca07f9a225e9217c9715e616eca757d0c2a01b398554d036cec5ab75276ebe9

  • SHA512

    644aa929f6aa9c5c8411ea3640da0d2c6571f724cc0f60306450e71b865e9af4ef34a2388156d3688741387c4a0ac3670dec52a97d7caed74d1589d5c1380bf6

  • SSDEEP

    6144:7gPvz3mMfn+npqXnQU9kekM00Ymrm+SNKkkTkBQ:7gPvJmwnQU9kebGmr9kkTkBQ

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2