Extracted

• • Target

    e5717edaf052f2516fe07f189edd66b8_JaffaCakes118

  • Size

    95KB

  • MD5

    e5717edaf052f2516fe07f189edd66b8

  • SHA1

    2811f9182c38446aa637e55f57bcad187b451e81

  • SHA256

    c4b7414f27118709ae8e78323eb9dbb8dac794b18309c4bf5c234850dc0378d2

  • SHA512

    d35c6a57af88afd4732170ee1bb40b7e7e94c336fa476644f979b8ea969badd4f36b21d6c7afef40a4ed30e39531e2c14e6a2b305e0e4de5a9e4b5aed011117b

  • SSDEEP

    1536:oR77zzocQqrasi7pleNRIBm+A6zpeQYvF1BVQokOItAyCEtEIIUxt9S6j:+7z/Ysi7ple/I0sEt1BVDICy8Uxys

  Score

  10^/10

  discoveryupxsalitybackdoorcredential_accessevasionpersistenceprivilege_escalationspywarestealertrojan

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Windows security modification

    evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2