Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.16f7f565341d9362618f0
  • Size 1.1MB
  • SHA256 b9cdd7a609aa7204f1e536c2a73d68fee12645e0ead25b6bd5e40abebd554878
  • MD5 cf1adaf922c16f7f565341d9362618f0
  • SHA1 a228973d64e9354d57a01528082c4d3b6eb65114
  • SHA512 593d40b2142ce1dad2fe7b6e542f6c4fdbb323fbacc1b637a887273a496aa0f40492e44d40f7f075110a0a8eebccc2e9362662d3644d6ca70a1d5b13b9fd475a
  • SSDEEP 24576:W1/aGLDCM4D8ayGMCPnXo8/Ob7w+PugoD:FD8ayGM0Xodnh3oD
  • TLSH
    T1BA354A736A870CFFC86223B4AC8723BA53349E61406ADB77A7D4C82F5AF39D46954701
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2