Extracted

• • Target
    0490b09bb9b0a45d2e5cda87b3f94f9c41ff6b395e65a2f484d922470b8eb995
  • Size 1.2MB
  • SHA256 0490b09bb9b0a45d2e5cda87b3f94f9c41ff6b395e65a2f484d922470b8eb995
  • MD5 282dc45dc6ce7eebfe4f3f72499dd6fa
  • SHA1 d06c48a5f6591576143c6215202176960333a842
  • SHA512 38bb576d5320f5eb368a7fd8a2f3c10f780a2b8d78b53638b696305e6b4971606b192e3731bf97c5e19ed70b43e5b19d9ea9caeecbdbee22bfb6ef981bf0c755
  • SSDEEP 24576:tUHnUxLetr4u8ZeXzUOLR4UHDHwBzyGv8Hte:SngL/MDHszyGv8Ne
  • TLSH
    T1BD459E11B7518072E2A111B065BADFB65A7C7D346B2185CBF3D02E7A88306C0FA7DF5A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorbootkitdefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2