Extracted

• • Target

    a1d15bcb93da89f08fdfaf4485ed5c69_JaffaCakes118

  • Size

    157KB

  • MD5

    a1d15bcb93da89f08fdfaf4485ed5c69

  • SHA1

    ae7982fb0b7e2f5c0d8c689430264571a807266f

  • SHA256

    bff61a91ce28a7dbd727861fa4082fbd41d0d95f886117cc3841e30e9d81e44d

  • SHA512

    19123d180830261f76155494d4266b2c4bb4d70d71c16ea2a17494dcc1fde62f1e33d8b74e2266d4f5a315ff391a869e8a7a4f1eb5f1c25cd2299563027042a4

  • SSDEEP

    3072:lWDnaKMq9HV05S1zwLv/dBTtaODXg9vjfE+mzpZ428:2aHq965S1zcTDXg9vjfEVN8

  Score

  10^/10

  salitybackdoordiscoveryevasionpersistencetrojanupx

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2