Extracted

• • Target

    8b7ff15afd5387dd67472183ee3565e76e82d62d86112e41a0938ea713744541

  • Size

    349KB

  • MD5

    af8b4c6d2670ca5c39a4bd04e4dae047

  • SHA1

    72b252cd5fdb7e6bcae1dca102ee9c567d7ac89a

  • SHA256

    8b7ff15afd5387dd67472183ee3565e76e82d62d86112e41a0938ea713744541

  • SHA512

    58860b69d048c5439f5d06bf645b6111d4d1d748f392eff992e0d817f81f1d7025f3bfe11b2ee9463178a6d8771644573d852e9a61121e00ed25ff17c3f7d5f4

  • SSDEEP

    6144:MAagfkTC3dM7B+mC4CVcZAfVxbJOqVBV+UdvrEFp7hKRft:MAagfky6B+mC3jJLBjvrEH7sft

  Score

  10^/10

  salitybackdoorpersistenceupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies AppInit DLL entries

    persistence

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2