Extracted

• • Target

    f1e7e1001aeb2e61073278dd03a57f69_JaffaCakes118

  • Size

    125KB

  • MD5

    f1e7e1001aeb2e61073278dd03a57f69

  • SHA1

    f3c6a4b785974217c1a1af914b19a6cdb0d8c5ab

  • SHA256

    646c5fa222b322fee4fd877e378ed1f555bd3ce081e2b32c810a2025fc923a85

  • SHA512

    78a1bed0442ecd39f1b9ac252e2d70909b03206efe735597eb55c80d68d78cdeb474384fbb69defe83efff2d7211e4e596b103ed65c1bd0d51daa026c4ac30e6

  • SSDEEP

    3072:dQIeRTXJSceAbl+mHa+iNn8PhTjuiCWLm:dmUmp+mHXiNnssHKm

  Score

  10^/10

  discoverysalitybackdoorevasionpersistenceprivilege_escalationtrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2

• • Target

    $PLUGINSDIR/InstallOptions.dll

  • Size

    14KB

  • MD5

    325b008aec81e5aaa57096f05d4212b5

  • SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

  • SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

  • SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

  • SSDEEP

    192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo

  Score

  3^/10

  discovery
  behavioral3behavioral4