Extracted

• • Target
    be8b1073b7564f71c799c4c1b3c3ac72e4cb2bf1a6418904ddd2e1cf761b045d
  • Size 1.7MB
  • SHA256 be8b1073b7564f71c799c4c1b3c3ac72e4cb2bf1a6418904ddd2e1cf761b045d
  • MD5 9e6ffbdfc57ab58c2e30ce4f9bc30bd7
  • SHA1 055fcd11cd9fb35ba5763b918dff0571e1ff6cf4
  • SHA512 4ece3f87005ae052092b35eb7c27737ab3c1471fd7bc27f66d2e3f7b99b8dec8b76d8e8f7dea543a835527144539ecc111c2dcb6d9ea6da42cdaf1e95146f3fc
  • SSDEEP 24576:qa8C13S78NyQryFFdm/egFk4ZVtxlc3cnunuAxc/2qbwHBkBcM2lE4ZEbL0HzCMU:qRNTjsLAxc+6whplEmHi8q
  • TLSH
    T10F85C062F3C08437D0331938DD17D269D52ABE113E65994B3BE83E4C5F3AA8139296D7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoorbootkitdefense_evasiondiscoverysalitypersistencespywaretrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2