Extracted

• • Target
    cee20c5dfd424fd2cc42c4215c1f65b2c7746f9f95adba2bc246e10dedda54a3
  • Size 3.2MB
  • SHA256 cee20c5dfd424fd2cc42c4215c1f65b2c7746f9f95adba2bc246e10dedda54a3
  • MD5 1e2f867e59bca936e326537d373318a3
  • SHA1 b25510e4b2ce0d92342ea3cfd2791e01fa157c5a
  • SHA512 8e20c2db37cc41c364f32d0c1c45ad90e2eaba967c713368c3b10e6cef135f84cc88b680b5e004300d46919f06a44dfcacc255b892b82deab9b886b2fa55ea5d
  • SSDEEP 49152:y5bAPHLY0N4w7oOi1HSgRg+3nkrBeq+8AtV+ydU4wZqAheEHkW:6bAPHEo4w7ovygKrw8OLP
  • TLSH
    T198F58D02BBD40072F67707319A7A5B715976BE712E31C18FA390A60D2CB1AD2D836B77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupxbootkitpersistence

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2