Extracted

• • Target

    4b7d3e4e1cf32b3f30fef4083162f10178adee61f8605cbed474bca9014919d0

  • Size

    2.2MB

  • MD5

    43c900612870d9fc70300296080dd027

  • SHA1

    0cda44f6f475e17bcd93dd03a47ae9c3b5af47c1

  • SHA256

    4b7d3e4e1cf32b3f30fef4083162f10178adee61f8605cbed474bca9014919d0

  • SHA512

    6473a3c8fb63a8b5050eb6a92c2880b55fae7592bc8b560360c8b8c5867a93d303908423d96a590300d0a21469cd4eab0d48ac86ef35ae5b0d2909213b1e5a24

  • SSDEEP

    49152:A2NCoXr1YqRQCFBsFHKYpXYIV3ldF7NrtOPpp+bclEnKz6y:A2xXr1YqlF6lKaYIp97NrtFjy

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2