Extracted

• • Target

    38ef6e3f8adb99e2bfd28565a7ae68d0

  • Size

    984KB

  • MD5

    38ef6e3f8adb99e2bfd28565a7ae68d0

  • SHA1

    7c94b8dbb3dd01409f61dfda0c064a939f6da88c

  • SHA256

    e396c2603706bbd286664645ee63c8565c588ec3179b964ce38b799dd89f2dd2

  • SHA512

    880fbd286d569a877e70a9575c081e4aee6fd424d27e51fd1f1de0a29eb872468736d928cca2c49cf89024d047c00925233353759453c71c8168b615179c10c3

  • SSDEEP

    24576:LfgNeyo9VyyBAjsXwTOqqgIztqDCGUOppYOR4t:rgNeyoDfXDqqgUtqDUtkm

  Score

  10^/10

  bootkitpersistencesalitybackdoorevasiontrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2