Extracted

• • Target

    2025-02-01_fe61638e689836d59ab380f80c603d7d_avoslocker_hijackloader_luca-stealer

  • Size

    1.2MB

  • MD5

    fe61638e689836d59ab380f80c603d7d

  • SHA1

    8babe0bd685a639572e820b24a20cb2b047c8dd5

  • SHA256

    f20e5a0c0c57f149405c928698a0df25419d14ae4f22fe6fb8b14c5cd2abdbab

  • SHA512

    3f14ad266d3d668f3d118e08e9071802377dbd66fd4c6b8b865521b38ea8f8e7a668c5a98f76b801874dd2e6ef48f7391324c4cc72086465abbe99b3c357f9aa

  • SSDEEP

    24576:f39kAORJa1/6YXgwYcbrW+5/85RkVeWXgGH:1TIIrXgCm+5UfkVZXg4

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2