Extracted

• • Target

    4dc3056d771e553df08b4f1fd1ec1c9c_JaffaCakes118

  • Size

    2.4MB

  • MD5

    4dc3056d771e553df08b4f1fd1ec1c9c

  • SHA1

    eb8c8106f5f86b0b28b803e73d2558c59072de8c

  • SHA256

    9d8e918ee0cc27fa240659a022b23a542b83dae95bf86d341f89582f619b557c

  • SHA512

    aa58ecebffb250cf749082098177e3de945e9c4e35e7674f6f7456fc7d48426d65a2be3d92390557dafc0781825ee4613dee84c7b7bbcd888da76d65736182d0

  • SSDEEP

    49152:M0r+eSD+HTaRbHRAaLlzRIBrLbakBen7z4JA3iOCjLyGD0H/Mw:M0ZSDcOhNpqBrncou3i1m7

  Score

  10^/10

  salitystrelabackdoorevasionstealertrojanupx

  • Detects Strela Stealer payload

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Strela stealer

    An info stealer targeting mail credentials first seen in late 2022.

    stealerstrela

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2