Extracted

• • Target

    d44420c28a018999d8a161a8f5498e045d7ff5df9321801c060fbf2bf9289dd8

  • Size

    2.1MB

  • MD5

    6f8bf15573ce0f10ffa13e8c3912e395

  • SHA1

    cff1c40a862a3d6569fdde0cc56997af23fc5cf4

  • SHA256

    d44420c28a018999d8a161a8f5498e045d7ff5df9321801c060fbf2bf9289dd8

  • SHA512

    440019f889364e886e8782a18d0180038719cca32a3dc6906ab0b9f0a0562ca0a0e5f69199e04f4d8deed93a3b1accea06df544e2cf7f4bd31f989dde0823ecb

  • SSDEEP

    49152:ITCDEbTK/e7kHXC+ArT+vtKRydODm7NrEOPQ6zBa1tGYwLvtn:ITdbu/MkHHgTMoyAm7NrEGaSn

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2