Extracted

• • Target

    faac43aa19a8477fc92b695ef532fea401bc4be6cc48de5fd5648cec1cb7cecd

  • Size

    3.0MB

  • MD5

    314d7f5cab8df5b4dcfb8f5110db4591

  • SHA1

    641c9cb0dc05bacf2b2f45aff32abe90b0c0079f

  • SHA256

    faac43aa19a8477fc92b695ef532fea401bc4be6cc48de5fd5648cec1cb7cecd

  • SHA512

    ffc48a7becfc438ba43047f0523d432facccc4a23b9b72e333a422b40144222e022ba64a2881039b7d5f53027b97dac30bed5fa62d932e8e1a18b91bffc0dd88

  • SSDEEP

    49152:xZ4rujE/CLlVl80CdSI3LdmLgWtAjkhAZ86LqmQKzeFH/LNqAznwj:x+ruj+CLflabdSgGhf6OFGUwj

  Score

  10^/10

  discoverysalitybackdoorbootkitdefense_evasionpersistencetrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2