Extracted

• • Target

    c28e527ac8f361559c9e9959ca5bcab33437a7c7ebf265a91fe8776a7729c38e

  • Size

    571KB

  • MD5

    e41c0ff56a14f2516d8e773ddffbbd13

  • SHA1

    404ab31280d3c127361353bc73b5e672a8aadbbe

  • SHA256

    c28e527ac8f361559c9e9959ca5bcab33437a7c7ebf265a91fe8776a7729c38e

  • SHA512

    3017e8f22b4d067daeb750b2edc2809aebe85c33c23f63062eb0f61731dba08f9a28b73083e9673638cdfc01c9db49653342fa49ff7acb508ff79c94cf35816c

  • SSDEEP

    12288:0DS7M/bKaa5JT+Orwm7nVSshTRbd5GTDXxQKJ:MS04dwYVSsV5d5qyw

  Score

  10^/10

  salitybackdoorbootkitdiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2