Extracted

• • Target

    2024-03-18_debe02b168a4f89db695c83009709f02_magniber

  • Size

    1.4MB

  • MD5

    debe02b168a4f89db695c83009709f02

  • SHA1

    642b056532c1151162efd80a68995fcfb3b79091

  • SHA256

    ca0a8c2ce9807265ba3e4946088370116d378850340d2e1a1798b5c55f6a7a3d

  • SHA512

    d578371728cbff4c3e29eb2ac9effd18f3bd5956028c966f5e96025a319131800bd8f4da29c5df075bf8655da4f118c00d9c4db912150242f3142f015fb0b891

  • SSDEEP

    24576:isFRhoq8oLxYGuzAGKFDuXNR2TGxTEcvC7V9qK7:fyo6xKFDuXA2TTIqK7

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2