Extracted

• • Target

    d33560019a5a749077a47473ac2126024b84e9e5c921abeba05d254a2890fa07

  • Size

    1.9MB

  • MD5

    57a614bddd8c37ab617b41664a815eba

  • SHA1

    190052ec8ffd96509731793b5f128eb3e18e0947

  • SHA256

    d33560019a5a749077a47473ac2126024b84e9e5c921abeba05d254a2890fa07

  • SHA512

    9399e6eddb056dbcf4921210309d010aad2f6f5bc5d678a7cd4bf0ecce38df3bcbb886014610800ebe93cccb454109c8bb133879f7d3845a56cd20399d76e222

  • SSDEEP

    49152:j19XaNKmSjvoxpWucxAA22VdbqBOdlmHCU:j19XagmYQxpWuOPAOdIHD

  Score

  10^/10

  salitybackdoorbootkitevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2