Extracted

• • Target
    e576ad5f99febc2bb2fa6fb51395f1cb92485be0d20ba5ca377d1e184c87c450
  • Size 11.4MB
  • SHA256 e576ad5f99febc2bb2fa6fb51395f1cb92485be0d20ba5ca377d1e184c87c450
  • MD5 015229656b0598f9f107693e00d8ed68
  • SHA1 be0dcfb0266cdf71ec0bef77109a74f90d7aea93
  • SHA512 a02bc3c50181d9b29276b95b4b23cbcf407cf6ce8f253dd06bd99bf632b0c05b2f6a51d69bf05d88cf9553cf23b1906e2e2e418334c063a7b05a5586bcf6c797
  • SSDEEP 196608:sd7AfTclLLHiYmkTVLGA1QOCCFrOY915vfBjCxVyoG+wIMcXKXnANL77oP7foJEk:C7AfT+LHmEx1vOY91RYyobwIMcXKw57Z
  • TLSH
    T19DC633B351254046E0E1CC3A8A337FD9B1F343A78A41EC7D69ECAAC72425CB5E613A57
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2