Extracted

• • Target

    6442f5f8b6b781ef063322b9d6068a63677587ff225304c5f0bc8dd59448e491

  • Size

    3.0MB

  • MD5

    523042c68af91c732917b5ffbd1f9b33

  • SHA1

    0398d7d5c297d35e0b66900a71c851112e056e9d

  • SHA256

    6442f5f8b6b781ef063322b9d6068a63677587ff225304c5f0bc8dd59448e491

  • SHA512

    7e90a5c5ac1321752ab725583c55b74453f17616f116d6309ab3b133066683c64dcdc57f96067d65201aec1f48eaf6d709e62834d9def99d08e3739bede689e3

  • SSDEEP

    49152:vZ4rujE/CLlVl80CdSI3LdmLgWtAjkhAr86LqmQKzeFH/LNqAznwBx:v+ruj+CLflabdSgGh16OFGUwj

  Score

  10^/10

  discoverysalitybackdoorbootkitdefense_evasionpersistencetrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2