Extracted

• • Target

    ed4105b51b5679bd792f4dc8843eacd6a5f3c8a12095c8c3b1afa4b38a56342f

  • Size

    172KB

  • MD5

    033c5a384fcc40db6ed32877cb68ddb0

  • SHA1

    a2a27a0377ece08f13484346e1ede5ae4eedc42a

  • SHA256

    ed4105b51b5679bd792f4dc8843eacd6a5f3c8a12095c8c3b1afa4b38a56342f

  • SHA512

    ce2c272f5137c0e8b2434691c0a915773c495537caf8487198c9275161799b1b19b335f4128424cde6b77ca56a9f265a46af18b0da5de0a628dc64aa39314686

  • SSDEEP

    3072:YnURL6GL7hxYDBmbB9Hrh253H0n8aRWpwRuc13f:GUhdlbE3H0n8EWpwZ1v

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies visibility of file extensions in Explorer

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2