Extracted

• • Target
    92a2c186c0f4168b62024c51ca2a803a427110e806a27c62e1d18740a87ede6b
  • Size 3.2MB
  • SHA256 92a2c186c0f4168b62024c51ca2a803a427110e806a27c62e1d18740a87ede6b
  • MD5 23f20b09d52d6d1a4747b21b9c9a34a5
  • SHA1 49fd9fba91856e6536c5afd6182ad9b9dca15e14
  • SHA512 cda5934f4761580330c066b38f945e64828f0a96903f58e37083448dd6d4ddae5e99b279a6aa4d65e1ef7910d887c65fdbd106a930d54bdb7bd6aa6922856dd6
  • SSDEEP 49152:wV1jo3iXnwfO+7NJBoydRRKGsi4yO3wc7zFcRziwiQV5Jf23O3y/ZqAW0:E1jCiX4NsSRRo99RKpiw5iZ
  • TLSH
    T117E58D017BD40072FA7707315A7E8B71587A7E712D31C68BA394AA1D28B1AD3D836B73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorbootkitdefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2