Extracted

• • Target
    jaffacakes118__7bb438bc64a86ddffab044711d9e79fb
  • Size 220KB
  • SHA256 a23b5b2fe197d340245790b3320192fb72b0ca496bbb9abe6d71bbda9060c654
  • MD5 7bb438bc64a86ddffab044711d9e79fb
  • SHA1 08adb8d810d4724d1b01c614147d4d99c2368168
  • SHA512 6ea12f39a79388431923b7000af985fff54c41bed4bbffe350b559ce2a66509aa10d0ea927afaacfc482f8484c76cf643655d4eb7a2d71fd757e8ffa6f9f8457
  • SSDEEP 3072:0IdcFLEdskgrt05bnwhVh6PTPdjsk4tJvXs7UM1mipicKqtk9jn+u3WGmAqnqFFz:RWjZ0xCVh6Zsk4tm7z1miUYWJnjWcq
  • TLSH
    T17C24D037F64B9652E32C39701687CAC6B317BCB52E934EF331A6376A8C71A104E4661D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2