Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.b1f1e6a7b5c9ef6b663935dd25c8cc4b
  • Size 261KB
  • SHA256 f995b191d2df51b29bf90beb53e735fc664c8df55a5b6f7924a52269cb2bf3b3
  • MD5 b1f1e6a7b5c9ef6b663935dd25c8cc4b
  • SHA1 2ab6201fe3191c7862dcb95df6d5d405d32fe7fa
  • SHA512 0374de10ea6120695e60a122e574921dc97f8c3a0f63585e6063c1d7d9f97111f9c35b96dd694cfa0435441325aeff48ff219f33b72a59b8874f08112109d22e
  • SSDEEP 6144:IN563OD7de1bxebYpBaRrNB2DElXGwV29wey+:YqOXdIteUGNQ6XnV29w+
  • TLSH
    T10444BF223BD089F2D8A760B40AE6D3A6BB77FA114B6191C7B3551B5D5C313D20F3A386
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistenceprivilege_escalationtrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2