Extracted

• • Target

    ba138dcfb2ccb33c1682f9568da2d27e1614baca9bcc238788d906bbc0a83dc6

  • Size

    112KB

  • MD5

    8873ad86a13388f5c4b2198e746bf4a5

  • SHA1

    27357991ce57680b2a81230fef18a7e1aec2aca5

  • SHA256

    ba138dcfb2ccb33c1682f9568da2d27e1614baca9bcc238788d906bbc0a83dc6

  • SHA512

    0392fb8e10ef929411960978932cf2c38b81b0a4df111d3f80751f3e2f3f2b521122a579e4d8767f85b9894c91bdbb867a3884abfec61f1fbf4d3c827f5c7e57

  • SSDEEP

    1536:/6GkJO8PwUkRGXrKAwn0TKWubtwiFhFKo5RyRoCLMIyT5kRvcF5VZA:S3dkRGXrKAA02PZtQQAvk5PA

  Score

  10^/10

  salitybackdoorevasionpersistencespywarestealertrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2