Extracted

• • Target
    cfb8346932c26d1c2844441f85f2ae1e
  • Size 102KB
  • SHA256 b0014ee0fe941ba8056aa17bc031d6411c093877bf3f6d19691d720850d7da77
  • MD5 cfb8346932c26d1c2844441f85f2ae1e
  • SHA1 64ccf86b58df8fa1ced7d96b2c1e06445c7dca45
  • SHA512 893861b15e63697f5bfcd76286b145edfc806b1ab6241523ccd261d42344f4b695b3ca74a398757242893a7dffc4a58ccd943c655a06817b037138548e17b3d6
  • SSDEEP 1536:O04ydFCvNmkaU+TUDdvY9Py10WXO2OkiIS8EcoqdW81jC7vJKrVM62lyuPviTDwl:140Ck9U+o5w9610oONTNcoaWAhRcvOD+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  salitybackdoorbootkitevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2