Extracted

• • Target

    2b9dfbcbb6562dcc6224d73b7483682f4e913f3e7f41d6e8a2204400ddb7feb3

  • Size

    140KB

  • MD5

    1e39eb571cd12cc426cb5cb26c370940

  • SHA1

    8d936b9e36cac7c31e2b7a166682683fcc810514

  • SHA256

    2b9dfbcbb6562dcc6224d73b7483682f4e913f3e7f41d6e8a2204400ddb7feb3

  • SHA512

    fa07804157373ec5b59a5d6c6c43a7b0032ce82d263eb1f90dd0144e687fa34df672d180ec041a38defe618377874f573a9efbc38dfe70d86b5a39d0830d0233

  • SSDEEP

    1536:Gs2/ng/CoNkt4z4vuyE8lZwJtFSPHl9RhTf0IwB6O1xK/QdDpSx2:k4/C4ktQ4vuyBr8tAX6BJ1x5dwx2

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2