Extracted

• • Target

    e1ce1f19c48d03d8e22a734dbd73b66b_JaffaCakes118

  • Size

    156KB

  • MD5

    e1ce1f19c48d03d8e22a734dbd73b66b

  • SHA1

    afc3bd7008db1e4c7c378c8f34c76f1eb0519c1a

  • SHA256

    cdd200e616ced75e60ddd6ba7b58978900cb56f824011640ee313ac234a99370

  • SHA512

    daed1d7ce753e4972f202c207838378c02ae36c877d62eb7c92bd1223c7ad7777a7be0659e603feb92c73e674465fd93871162525c84dbf671f3c4cafbe6b999

  • SSDEEP

    3072:YkjAy4dDGkJ9vJYTJ/hbd/UDCi7XYbmRnSN67LYgb2bKSZ56/e:Y2cW9JblaCcnRx1KeSZae

  Score

  10^/10

  discoverysalitybackdoorevasionpersistenceprivilege_escalationtrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2

• • Target

    $PLUGINSDIR/InstallOptions.dll

  • Size

    13KB

  • MD5

    d765c492c21689e3d9d61634371fd861

  • SHA1

    ac200933671ae52c9d5544d0e2e8e9144d286c83

  • SHA256

    551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc

  • SHA512

    9919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f

  • SSDEEP

    192:9B6RvrfvOuJQDghBy/X7QKq3TLGciZJf0EzWzMnz6WoF1dBs:v6RrviWaX7eiZJ7nz6bB

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    $PLUGINSDIR/System.dll

  • Size

    10KB

  • MD5

    fe24766ba314f620d57d0cf7339103c0

  • SHA1

    8641545f03f03ff07485d6ec4d7b41cbb898c269

  • SHA256

    802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd

  • SHA512

    60d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3

  • SSDEEP

    192:rO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1aMBgMO:yKAFERdlxhGRYUzqZaMB

  Score

  3^/10

  discovery
  behavioral5behavioral6