Extracted

• • Target

    JaffaCakes118_5138877efb91add1428054d9237682a4

  • Size

    725KB

  • MD5

    5138877efb91add1428054d9237682a4

  • SHA1

    36d87f02177b179c960fdd5f35c374fd8b8bce36

  • SHA256

    881c0ae199ff540027f700b966203eca1995c2a6f26d15ffb7ef659fb24716fa

  • SHA512

    47ef1398c5eadfaf76ed12dd8ecc4353ebec02d0ea86b6361c1e2741d0dfb5297ca5e69877dd381a65f929db9e797f8866fe0ecf768d3612ab1529e30e2cd8da

  • SSDEEP

    12288:r6JaPehDSsMuGIC0WoFlwe25Ef50MQdVahkfz5T+92fHz6:GOALMJ4Dwe25EfuMQbYkfJi2b6

  Score

  10^/10

  discoveryupxsalitybackdoordefense_evasionpersistenceprivilege_escalationtrojan

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2