Extracted

• • Target

    ce3347a87519c134ca0e04af306d6f37af67c54f1e95a2364657ec308a46c765

  • Size

    348KB

  • MD5

    822d4721567e5949cec4dc94fdb24f35

  • SHA1

    3f165fe5cd15cf64a08f5f672d979815c67777e0

  • SHA256

    ce3347a87519c134ca0e04af306d6f37af67c54f1e95a2364657ec308a46c765

  • SHA512

    4b392721db35837ec075fe749fb7968acb77e84a37dc89469b2697430960dfcc08dd6b921012d310cc3d6947e3fd36605bd6a1a12d52ce95264cbba1cb62f2a0

  • SSDEEP

    6144:LrGABDkpgFSiFFg5IN7th9B1BW/LkzDLATnErFAJ:LrGABIgjFgG6/KLATnEyJ

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2