Extracted

• • Target

    7481b6f2f8bda490baf6e5ec236fd2c4f03db4b31486e5dfbb81dd3dee9e0a0b

  • Size

    104KB

  • MD5

    07854a7f983b15b21792928f2d95c82c

  • SHA1

    fb77c0ce27a032207a4400024857ab2b278bea2b

  • SHA256

    7481b6f2f8bda490baf6e5ec236fd2c4f03db4b31486e5dfbb81dd3dee9e0a0b

  • SHA512

    780e870fc153ae7a3726bc4181dc868acf5f6d590b4b2b865ae13522d7d5ac54c00e576fd70b15a027069d6136350507a1b232cee12ea32bc64d45134edbe8c3

  • SSDEEP

    1536:kPJA2Y/FuDs+72tFouKxA5ziEgapOjQ9Mgp2vbpzL8DHdxLYoMsRDlqJmJit:syNKxWmAF9pM09yTsRJq7t

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2