Extracted

• • Target

    d1ff8352eb29212fd7b3cde9e6872368_JaffaCakes118

  • Size

    1.3MB

  • MD5

    d1ff8352eb29212fd7b3cde9e6872368

  • SHA1

    14a9d7bde2c549a72fd448d7394c2688501a7443

  • SHA256

    de3ffd1d1c48455b558c91a48b5fc2c20e0715ac402865eb3fe234f141dd6d82

  • SHA512

    92295911c9df790bd3378ebd3549aaf3e1f2a858226ceebc9625a1bdb5381fb18c769b3a2b4a198068adc833a9f591d6b83fd9b7d75aa61960b34c3a0686a5cf

  • SSDEEP

    24576:yWmgKT7JKlrQdLxmkPYPdAlPzRdtaJ19dLWVFRh1BdrCPknyLBDMu+:yWmxpKSgkg1AFFdta5dcFRh1BZckkBP+

  Score

  10^/10

  discoverysalitybackdoorbootkitevasionpersistenceprivilege_escalationtrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2