Extracted

• • Target

    JaffaCakes118_54fb181f4163d20fc750ab50f3c1d179

  • Size

    6.1MB

  • MD5

    54fb181f4163d20fc750ab50f3c1d179

  • SHA1

    16378a93d90ad290266666efa9b23ed44889d01f

  • SHA256

    28e2d575f74b76126a9b0497b4a31ba6ac790522f8dee41e58ba85c83ffcb93b

  • SHA512

    a431e2000ce3a143a4d4aef5bc8de02fbf9aa1b56e7fdf6dba0e9a443b1ab598494233cb9ee6875cb2f49ce500ecd3beca8342382693837ab26b5480e61bd109

  • SSDEEP

    98304:ItDnvUTxCTjG7/cLb7aJnWPxoL9Jz4YZTN8Dd4N7szD/YRXizflXyq:ItDvUcTi7gusW922TNrN7s3/GiFy

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2