Extracted

• • Target

    2cd0592a39007f38d8a03247af2439724c0ba90856c60eed7e7917f7d5a808a3

  • Size

    1.4MB

  • MD5

    6596a89e0ace7b3af3529b354cebd23c

  • SHA1

    a1e8100872087ed537b5dc7a9f8dad013c827b99

  • SHA256

    2cd0592a39007f38d8a03247af2439724c0ba90856c60eed7e7917f7d5a808a3

  • SHA512

    745e992b4bdb81a2c07b4ce32152f034a9e6a1c9c4e099ba10744159b5908b3d8b1364bd0005df5ba23a99aa8b7399163cb7aec3020d1ff2f5f97a812870e677

  • SSDEEP

    24576:uBKv2cjlGeai4s5+fGL5H0MOtw0tbp4J6xDkg7zu2beAL8:aLLk8g0oGaJEDkg7zu2beT

  Score

  10^/10

  salitybackdoorbootkitdiscoveryevasionpersistencetrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2