Extracted

• • Target

    a2c9dd289a08064d1dc6d3d22f92f0a8f586de15872bfecd2ee9bf0453e6fabb

  • Size

    145KB

  • MD5

    4c91f31bf0e12ec964ada8dfe9c47566

  • SHA1

    6bf948f4012d388e3ca8728134bd439f28a51474

  • SHA256

    a2c9dd289a08064d1dc6d3d22f92f0a8f586de15872bfecd2ee9bf0453e6fabb

  • SHA512

    e8489c897d84ee4cde7eb63c398c022669bfd09078acc5e55b487e29f8eae04eddd460e362244043b4a959e347e4d010e17153d492fde8b6cf5620e352bfcaa0

  • SSDEEP

    1536:Nvcyzg++et20eMCuys0kMqDEHHFNerDGx8Uw0Krnr+UUJQCs:NvVz6K3dCHEK8Uw0anr+X8

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2