Extracted

• • Target
    465e4422653c236f6ffcb85b22280522f9882b44df864d5b3ab68bb72974e1cd
  • Size 1.5MB
  • SHA256 465e4422653c236f6ffcb85b22280522f9882b44df864d5b3ab68bb72974e1cd
  • MD5 4ac40a328d96590abc0017e9232407f6
  • SHA1 47e763ece0f30b991ca2d81851ffb5497e9e1877
  • SHA512 23a9ca6b8e81a92a1bc6512e64eae64652d43edf9ea10d23b48c2ce9ae860e6a4fd1e98ed7a6a74e45f8d95b0ff169d791a54aac5bd6c2c2d7bf25926348e1af
  • SSDEEP 24576:9+45piNg2ILkfg+kJsxwSoPdVoBjCvuF17+2NdJfiOgUv+FtibXPBWZ:tLkn+SoPdVoXiOgU+FtibXPoZ
  • TLSH
    T1E6752810B7A84631F5AED5BE55BADA39D1713C912BF086CB13C1BBAA1D375C28431B32
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1