Extracted

• • Target

    JaffaCakes118_689ef0f2e6af8ad3d32ab57e1b21a5ee

  • Size

    1.4MB

  • MD5

    689ef0f2e6af8ad3d32ab57e1b21a5ee

  • SHA1

    3dd4725886252418e31e12ab069e73b12d6503b3

  • SHA256

    52a7d48f7b130539b1f1c97736170ced7b48fe38473656a7d32405a9ca20a586

  • SHA512

    c0695108cc48873f59aa149328320324f0d3ac208910465a57ef177173a0d6fc73cf62b0ebdc8f51c355134f09d7445328412d22ee6bb8c1490ad641bdd6bba2

  • SSDEEP

    24576:2QuC55ocNjUen9Orr/dJN8DIo6YqJWVzlF2jXAo9ImxkSe8dZYZn3a9J4Ws/HIvZ:2zC5KcNjUg9ijN8Dv6TJWxlskfm7e8dn

  Score

  10^/10

  discoverysalitybackdoorbootkitdefense_evasionpersistenceprivilege_escalationtrojanupx

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2