Extracted

• • Target

    7d9d40727eac4b8d83dedddbfd4a11977805d05c6e698cc05af9a4a2ab38b6f9

  • Size

    2.3MB

  • MD5

    dc958b63007cf0834f72176b70cfde59

  • SHA1

    6c03adc88090958adfcecb4aa199796e0d49e498

  • SHA256

    7d9d40727eac4b8d83dedddbfd4a11977805d05c6e698cc05af9a4a2ab38b6f9

  • SHA512

    7b0e53bce9ff766d67c73601246fdce1760e11273d05cf76f4443c05c17cf7617fa59dc27b93a3ced47991bc5294e3411cedb406722d4f85d811b808631e0043

  • SSDEEP

    49152:0Gg8HZ8n9cwUBRI8CCSXMXkHilomRU33QyWs0bNRI5SIfo7YDS1BMBd:FtHZ8n97GmqUHiXUw9NaZfo7Y27Mf

  Score

  10^/10

  salitybackdoordiscoveryevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2