Extracted

• • Target

    5a7c45218b50cee54d32131695d55f385af24c37d0b9a788de9ea6c465005293

  • Size

    128KB

  • MD5

    21e9a4adbf70b295fb6b81f7998e9c39

  • SHA1

    2f6b14983570185fa111ca30a2848a7cae32792e

  • SHA256

    5a7c45218b50cee54d32131695d55f385af24c37d0b9a788de9ea6c465005293

  • SHA512

    ab67f371ae40645de366052359b94fd28feefdda6afcfb794407f0460905a68375af5eeb1e9c7453509450d68b165c7a46af76b893bf611fb5243a5dfa65ff91

  • SSDEEP

    3072:uftffjmNmcoa3b9OBFhfY6XHNNTGkZm1MOTLjAimC:WVfjmNm+BOBbfY6XHjSkZmGgjAiF

  Score

  10^/10

  upxsalitybackdoorevasiontrojan

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2