Extracted

• • Target

    4052e869d0ef5649ad0bb14c7cdffbcf_JaffaCakes118

  • Size

    88KB

  • MD5

    4052e869d0ef5649ad0bb14c7cdffbcf

  • SHA1

    2f2eef12131183bb414d8189450d89a9a83ca604

  • SHA256

    fff826d7cf48b6cbef49c9eda8b7a33205c90be8d3254de4589f1a3acdd74a21

  • SHA512

    61c3667bfa5c3cd981023372eb5fe29b479b25d7d53bb2c4b58c2cf16568759ec872cd34fbaa386dbe47ef55634913caa35f6cd360dff4d645e441b5c31cbd4d

  • SSDEEP

    1536:UyrizN3klVZ69QPiPy7sw2Sx1vXvfAK6skKjFsrHAstd:U1N3kPZX9sS/XbDps7AEd

  Score

  10^/10

  clopsalitybackdoorevasionpersistenceransomwaretrojanupx

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • clop

    Ransomware discovered in early 2019 which has been actively developed since release.

    ransomwareclop

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2