Extracted

• • Target

    957657c347815189c437f7684f6f49986856c230ee7e700aa48fbfa4ef83feed

  • Size

    424KB

  • MD5

    d490d943a216882589c256883f2d1795

  • SHA1

    81d6d521f838360632f7d93366126ed1a637c380

  • SHA256

    957657c347815189c437f7684f6f49986856c230ee7e700aa48fbfa4ef83feed

  • SHA512

    8a350451f5277eff5890ce105ef664f3256aa123a8587488c22a4f4fcecbcfd628b2a09de3685a5570495486250682a8e488ba65740979421341d9caa54ea016

  • SSDEEP

    6144:UlIo1bqQ7pjAkcc+kLQk7DGLMWHCq79Zh34UH/ath3E4vQ7McarNwBJph+:Wxb8c+W7DGQWH179ZBXH/EWYreJa

  Score

  10^/10

  salitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2