Extracted

• • Target

    9c58c02110aeab8465e4866058f2d118e4b4f79cbcffd24868f4c52e87bf3497

  • Size

    107KB

  • MD5

    17a74a37bfb05ed85331b80255c9ce40

  • SHA1

    57fe9a817940d97da76eb4741a0ffdc02ce566ba

  • SHA256

    9c58c02110aeab8465e4866058f2d118e4b4f79cbcffd24868f4c52e87bf3497

  • SHA512

    c4029b5ef53d606f8c38e497bf8c91e4939c3c8b52ebbac82c16c51f31f836fd6f14bc2ff1c8dd99c5b1120ff7530a8dd8319828d0e78b0e8fc4ec37fe7917bc

  • SSDEEP

    3072:6WsPFTZmIHpKAiAqplvk/kZ6N7Is1PM4XL:JsNNhH0Aac/rUseI

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Drops file in Drivers directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2