Extracted

• • Target

    2024-05-27_78c4557eef14a41f9510965dd4ad8535_snatch

  • Size

    6.9MB

  • MD5

    78c4557eef14a41f9510965dd4ad8535

  • SHA1

    e46244054d3963bbed886c3178d7a8c252ad0205

  • SHA256

    a7b12d3c32b6163c32ab51723533cf1e78109eadfd942004a43ca4d07be7c9f3

  • SHA512

    eae0dd342ee68a3eec9c85779b14ce634c20370e1a79395a4dbcadb10585c36fd65cc0fdf3a0e85c235f0082fe7000bf5aabeed7443d386c0269a0cb26165c6a

  • SSDEEP

    49152:QN5GClv/H3xONiz8xmHVibPyZ6fe/ZLYwSdT3aYPAFw4OtpCw/PAd1hFUlMXi5gF:GlvsigIHV+m6fmLbPXXKS5vfbv

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2