Extracted

• • Target

    193c912f6dd6be09c3030bfc102bfe509181e02ccc59a38d4358712f4affe966

  • Size

    356KB

  • MD5

    73deaa02a442a58e190e810722835f4f

  • SHA1

    feedf067912cd7f7259b5aef7343427e079bf966

  • SHA256

    193c912f6dd6be09c3030bfc102bfe509181e02ccc59a38d4358712f4affe966

  • SHA512

    9be75cf27adcd5c7b7e8f90c67d1c26fa491d31ab5b7116cfbf3f8e291266a08c628b5e46d111774ea1204342055787d5582b6f70a47cce62ebb8e0a45de8291

  • SSDEEP

    6144:ETnjnvrM3mjHGh5Doh9Z5cAea4Jv81E6eiqgq8WfV5vP1:EHn438Hwerea2vEEriXq8WfV

  Score

  10^/10

  upxsalitybackdoorevasionpersistencetrojan

  • Modifies WinLogon for persistence

    persistence

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2