Extracted

• • Target

    6358baf646fc9771bd0e9d5558b1cb9a

  • Size

    862KB

  • MD5

    6358baf646fc9771bd0e9d5558b1cb9a

  • SHA1

    9c97a4e96115c864b602b1c6491737a48a14010d

  • SHA256

    04a3c57f95280a980bd5ebcde20f4728e5dafbf445cc3ac550b32836002b2dc7

  • SHA512

    31c6ae172c63eaf4409d1ef34d2fdecca98755272519c133176f94d71a47ed297c931c8125debd29ea7acfb14c7c9fdc187b278b44cd66b0289174fbf819f118

  • SSDEEP

    12288:o+FBomCpJ9a/tLhZxa4u1cl9WYvyzK/Ok0D1zP4zrw3pGs:TBomCpJ94LhZk4u1I9WYZ/CB4af

  Score

  10^/10

  salitybackdoorevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2