Extracted

• • Target

    5f0f52dee306ee1ec3ed87df5d8503333e7ef280b6011b357cc11cd2a85183d0

  • Size

    134KB

  • MD5

    0731c0cd8400e087ad065a82686a6fae

  • SHA1

    8d44f6c1621480dd30a9b17fc95b6bc429c6260f

  • SHA256

    5f0f52dee306ee1ec3ed87df5d8503333e7ef280b6011b357cc11cd2a85183d0

  • SHA512

    4fca435a8aef60677052797089d08795e631a7d41b3ce9f5c5f783bd29a11c4341ff5b79e4514f2bbafe2cd0761ee9327ad47cbe7b89f8ff9ebedd9103065fb2

  • SSDEEP

    3072:8Lk39uhYXJP303E0sJo8/Ev55SEK1OQflFM1hhRP8mmAM6:8QXpE3AP/ULI1OQHM1FPCAM6

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX dump on OEP (original entry point)

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2

• • Target

    $PLUGINSDIR/InstallOptions.dll

  • Size

    14KB

  • MD5

    325b008aec81e5aaa57096f05d4212b5

  • SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

  • SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

  • SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

  • SSDEEP

    192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo

  Score

  3^/10
  behavioral3behavioral4