Extracted

• • Target

    03ac5ed1ebeedfdf47ff39ef09de259cdcc8b01f9169150580422b6851fcee81N.exe

  • Size

    809KB

  • MD5

    3128d3ba3ed2e39082fa427f7d510430

  • SHA1

    182842c987eda92785d174d91078ffa26280e206

  • SHA256

    03ac5ed1ebeedfdf47ff39ef09de259cdcc8b01f9169150580422b6851fcee81

  • SHA512

    b063ec60cb82198d6a8230158f8f9c5e31ab04f187d5cec73bad9b4da4f2086ccc86db911e2c671767138104420a98adb70174b6c377fade2daee4035ab04e06

  • SSDEEP

    24576:2a7JfMkwaNuO1ugbaGKaQHT9+xMceJQ846pPw:ZlqMbaGf+TgxMHJb46pI

  Score

  10^/10

  salitybackdoorbootkitdiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2