Extracted

• • Target

    2025-02-01_10c76746109176e04ce406b16520fa75_avoslocker_hijackloader_luca-stealer_qakbot_revil

  • Size

    2.6MB

  • MD5

    10c76746109176e04ce406b16520fa75

  • SHA1

    352e197a698f9e95695e9ab83ced0a3575aa607a

  • SHA256

    ad1524664c8ca0a11aa5d094d27c0e8d4dd3066205618d9e96bb64d6cc5ffcf7

  • SHA512

    f73ccad63d987adf54043d9778b52539fce4d0eac77a5108433ea930f5ff39eb4c9b226a917a79a9beda1be59978aae1856bd7f67ce9f6642d38c578e3c5a470

  • SSDEEP

    49152:a+v9SCwO8KmBS6r5N0GMzky21EtecwdT6UCygtPlTueqawmXRZ3TRuk:a+viS6YGUrkEtecwdT6Uc3TueMmN

  Score

  10^/10

  salitybackdoorupxdefense_evasiontrojan

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2