Extracted

• • Target

    c6e10e3351d1a360b09a51634ca4185c5aa1777c4f3a7dce14f465dd86f02276

  • Size

    3.0MB

  • MD5

    6a934331cc192556fea5ab3798fd3cfe

  • SHA1

    8f4e37602d1d5acb23cd73f0277c15cedbac5573

  • SHA256

    c6e10e3351d1a360b09a51634ca4185c5aa1777c4f3a7dce14f465dd86f02276

  • SHA512

    2c1f58a27df2479a8d05900a24a3ca93cc48e936dd07ead3b5ed1edf7f1e140f539e31c5b99c1a59ac78d8a6d207873044fc70cdc64787a957a5e08852a291e2

  • SSDEEP

    49152:sZ4rujE/CLlVl80CdSI3LdmLgWtAjkhAd86LqmQKzeFH/LNqAznwD:s+ruj+CLflabdSgGhj6OFGUwD

  Score

  10^/10

  discoverysalitybackdoorbootkitdefense_evasionpersistencetrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2