Extracted

• • Target

    2024-12-16_042ffef8ccf20f6ab7c94d704ad25725_bkransomware_floxif_karagany

  • Size

    2.4MB

  • MD5

    042ffef8ccf20f6ab7c94d704ad25725

  • SHA1

    4023bef967ab6e582d95cec7cac86ffeb68f5900

  • SHA256

    a32ef8ac8833e9d0d1a87aa6250986ba02af089f0f394576027a44de8683e225

  • SHA512

    11dfae4b75bad1fedc8aa37dbddf768ee935a20c1d603095e667760525c0b943df662c56aeb07522e3f697c3cf9b26a072bcae86a2bcd32871b5d1dfc861efc5

  • SSDEEP

    6144:0BbDJvVo23+FM2+zIv+qgmeeyeDMzJYTxJxBV+UdvrEFp7hK7c:aDJvVXt4lDaNYTJBjvrEH7+c

  Score

  10^/10

  discoverysalitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2