Extracted

• • Target

    f74d2a96da9a4ddf6889de9bdec5198d5ded0aa68b4685da3034c800f0becb9b.exe

  • Size

    1.3MB

  • MD5

    82fd13290e8ee8ba2260928fdb0aae3f

  • SHA1

    5017f2a03925b396d20f8132b6a426588249a17e

  • SHA256

    f74d2a96da9a4ddf6889de9bdec5198d5ded0aa68b4685da3034c800f0becb9b

  • SHA512

    c0e716b2bc3501944d3cebadf94e56ca9c3f83d1eb74c1fa1c1da480229248150a52c9e99e162743b196030426aac069e175efb31a6cc468930514082a796eeb

  • SSDEEP

    24576:wQJFy0QEUAHAFAA9uhI0QKMKapBBW00SL5V0EBIK:tquhxpt6BBW0/9zSK

  Score

  10^/10

  salitybackdoorbootkitdiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2