Extracted

• • Target

    76965541f046ef1b91d94bab076165cd762072c9da402a33c7680d370f1e0f5b

  • Size

    192KB

  • MD5

    bca6eb1c83ae7c14cad0e38ee668dc8b

  • SHA1

    141ca23b9672526b87301682c1f7ff6041885e5a

  • SHA256

    76965541f046ef1b91d94bab076165cd762072c9da402a33c7680d370f1e0f5b

  • SHA512

    dee4add4c740f30eae0eca4ce9811f70b31a2317e1366dfce10dcfa23244c26fd2da49a1ddde36047478d637ee9725f55c24f99bc5bbd18fb30fb3833311c999

  • SSDEEP

    1536:pweaUFFoHxIkccoo/Ev0uBtMvpm8CpelrlBj8Q0YvU8dVnMYDfp1k:pwhRcY/sMBm8CslrlBo9eBh11k

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies visibility of file extensions in Explorer

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2