Extracted

• • Target

    7373e863b10397c6cd7bcd73203a7e1cf670764999fd613ad6c913d3ba4be367

  • Size

    390KB

  • MD5

    375355f279bd0153e600bc2ea402e5d2

  • SHA1

    b9594c2210bc3e5eb74159c00d70afe8efe0397a

  • SHA256

    7373e863b10397c6cd7bcd73203a7e1cf670764999fd613ad6c913d3ba4be367

  • SHA512

    9ad64b5a92315daa74f208242f3a575c816211a77c23e1c6782d4497d2c116c5eb01795627d7e0a4f4c964627c040d7c5fc1ed00197da2e46c6f383e1069d0e9

  • SSDEEP

    6144:82mBQ3nQvtoFxpNsTrZ0+T2iGiIMXOrWnuopmp4TyQOI5JgpcvqNplcOtYl:82mBQgqxpNsBffbzXU9GT0Iw5pBte

  Score

  10^/10

  bootkitpersistencesalitybackdoorevasiontrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2