Extracted

• • Target

    973550c05749ba96fffb99b977be7b790488492691ea275155844a23acb7758d

  • Size

    4.0MB

  • MD5

    d690f48612cebdedec69b668b972b075

  • SHA1

    005b3fd94ba7a0a112ce40c8e36e8964c1a2dc57

  • SHA256

    973550c05749ba96fffb99b977be7b790488492691ea275155844a23acb7758d

  • SHA512

    4778eacea8f8238b6b0db042bcb98cc36a985a6f0cc2319e5c7bbc1d6f4b73ee5d8283b1f2a995728f7bf5142d304791cf173a9e646c110bcd9cfa9484d62e2c

  • SSDEEP

    49152:WAhAkT7I/8BgW9vnGoUnBLSnerYyKI70F+LfftrTtQ21kOgQUrW4tAvNr5dw2DEm:4UeSvnGooBLSeaZF+DfttZUqoAFTjEm

  Score

  10^/10

  salitybackdoorevasiontrojanupxbootkitpersistence

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2