Extracted

• • Target

    e05e396f6d95094185e91ee6141e66a9_JaffaCakes118

  • Size

    232KB

  • MD5

    e05e396f6d95094185e91ee6141e66a9

  • SHA1

    0ada554f270baffca0f365533a456a31f3d8e667

  • SHA256

    88df095a28ea561bc2a8f6e96b8c58ce4496ba4562c54c3e32c93ab4081d85f7

  • SHA512

    8963f746717fe0d62458095c2325522271c1e82585e1ae4f61710ca712aaa35417be6dc4e30b8b39a73f11ecad0d024923ccff1639d16af246b229061c086710

  • SSDEEP

    3072:FagmvJfdXVCAX73xRRdr9evN0QfEs8qGu2wFEb:FfCdlF73xfdQvN932eS

  Score

  10^/10

  discoverysalitybackdoorevasionpersistenceprivilege_escalationtrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Disables cmd.exe use via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Drops startup file

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2