Extracted

• • Target

    b6d34fa0ff75e5a9dfdd2a5afb44bd26310874bd7a016a7534b96a497f1da857

  • Size

    4.0MB

  • MD5

    8f9c2b89d0b4cf0d8dbb443d78f5c610

  • SHA1

    e6f8d634f5a8c76c669de48300bf082a20fbb68a

  • SHA256

    b6d34fa0ff75e5a9dfdd2a5afb44bd26310874bd7a016a7534b96a497f1da857

  • SHA512

    a40832ef36fbcc8be71ad27854873da9dc77531ec904880c9a4eb639f8959c8a7d5b1aabe5fff1d98059cfddb6f36dda435bafaef257e38d44d6b6400d1035fe

  • SSDEEP

    49152:nAhAkT7I/8BgW9vnGoUnBLSnerYyKI70F+LfftrTtQ21kOdQUrW4tAvNr5dw22Uc:vUeSvnGooBLSeaZF+DfttcUqoAFTWN

  Score

  10^/10

  salitybackdoorupxbootkitevasionpersistencetrojan

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2