Extracted

• • Target

    c24021161d7667ede9dd17081d1cb52d7104f3b0366aa21ae9aacc42d9afaa7f

  • Size

    2.0MB

  • MD5

    bd82320d64112a9356eaac7f477ecc11

  • SHA1

    631042008190119327e430f1511783885af74b36

  • SHA256

    c24021161d7667ede9dd17081d1cb52d7104f3b0366aa21ae9aacc42d9afaa7f

  • SHA512

    2ecf271c05a8021d07959b1235a4427fcc1b2455ac468d79ef5d9c3acd6632292116fcf8b663c60f8cf2278a2c7bc545b624914b61288662d57dc12ffb3538c4

  • SSDEEP

    49152:UuriL899OM/gSY8wHTsb+92hnHO6xfV6vq7NrpOPfgLs1OADgMbp:Uuri+9jgSY3Two2hHXxL7NrpjI

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2