Extracted

• • Target

    05d0a79822dd1de231bdbd6555b0d53ac151e9e30c799dbbdfcdaa823aa5a5c2

  • Size

    3.0MB

  • MD5

    6db7a5e9ed3c44dcd1db99dbd0779085

  • SHA1

    16240fd71f10389904585142737698bda0191fd2

  • SHA256

    05d0a79822dd1de231bdbd6555b0d53ac151e9e30c799dbbdfcdaa823aa5a5c2

  • SHA512

    4a93397e3913224fc29c66bf826340968a24fcb4b96fc713dc6f924e7b63db434f4f943fa8917e0de29b307f97f80b3e74f768e11f4acaf26cb5a165974aaf20

  • SSDEEP

    49152:MZ4rujE/CLlVl80CdSI3LdmLgWtAjkhAx86LqmQKzeFH/LNqAznwoZhO:M+ruj+CLflabdSgGhb6OFGUwoZhO

  Score

  10^/10

  discoverysalitybackdoorbootkitdefense_evasionpersistencetrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2