Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.0000b50507808c6f402a0
  • Size 1.1MB
  • SHA256 d227a6d9c178fd296c112a2dd62e1daf756c2c9950e150ed9ab80c08a92189ef
  • MD5 061aaad07a60000b50507808c6f402a0
  • SHA1 aeee998a43346505113bdddca2ce0a4aea7024c1
  • SHA512 7d870e113c9a31b1d48bab9c1b8fc36a70f468aa37d31bfb7a8c0019c1fa4991a92026571f0c0af592e0362d858d412525e8b792d6e646a00b108ebc22b633f7
  • SSDEEP 24576:W1/aGLDCM4D8ayGMCPnXo8/QorYT5JYX56ztMzjpZYtKXnASYLew3iIdfuYiS2k3:FD8ayGM0XoBoYT5JYX58tM3py1ew3iId
  • TLSH
    T15E358E12278B0CEBC893E7B4664F13719734AE388D17C79567D7C83BAA631A27D1A305
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2