Extracted

• • Target
    069f6c1f95fe98bd012e4e770ea2a2fd_JaffaCakes118
  • Size 983KB
  • SHA256 d201ca35b14699011ec0c36e3bd4650f654002767d1849cbc6f066b198333228
  • MD5 069f6c1f95fe98bd012e4e770ea2a2fd
  • SHA1 b0702725c35f3c7e5dcecc83008409679ab7a95c
  • SHA512 6e95956347ccad1740e7ff31cb22ba27a7119806c1602742c1246c4e52a832cf993bc1b7c38bbd7102cee45c05eac63c7728b4ff92f57dd5dd660f1451f64557
  • SSDEEP 24576:cmgNeyQJkJLpIZqXPGPPm4rNR/AyufpYOjF2k:9gNeyQaJLpIwXPGPPm4xGyjk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  bootkitpersistencesalitybackdoorevasionprivilege_escalationtrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2