Extracted

• • Target

    f01961809cbb9eedb117eade77367412d2b19e453114a8bd75567a2d287b0d19

  • Size

    1.6MB

  • MD5

    2d7b69ecee41e5aa3be0ea4a34f41538

  • SHA1

    6836c91bb84d04173ede09f9fb2bc8690c5dfd03

  • SHA256

    f01961809cbb9eedb117eade77367412d2b19e453114a8bd75567a2d287b0d19

  • SHA512

    4c864d13b32cabb70514ed1b13ec203b382b3e4882acca64e9e13c573a7bf89ab9d0df51348edf6c7c083debc2ad1f506d60f8425b682484ea927e2b2a20ab7b

  • SSDEEP

    24576:upAgq8HmTj6scESQXO2yROr5jDBM/cTKcdG2ueNeN:GAgqTTSbvROrhDBUcTddG2ukC

  Score

  10^/10

  salitybackdoorbootkitdiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2