Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.0020f9ae4f4fab540bad030b99c0d7c0
  • Size 1.1MB
  • SHA256 8891a7bd82a4b07968cad0ced261dd74be53a585f28012c1619bc1bd97e39760
  • MD5 0020f9ae4f4fab540bad030b99c0d7c0
  • SHA1 72321e7b1eeb8e89ddaf79464f9f7e915bbc2ead
  • SHA512 7229bbea59da9423163f940ac3451b665a6578ce23f16b92065f7b2087927de68369a27db04652dc06f184b43699c240cb2733adf8922f0bb982a27b5e57605c
  • SSDEEP 24576:3+O/h69nTnguYDDD1Iq+Q5OS8QmoaMQv4:3+mgnzur1IqTOXQeA
  • TLSH
    T19535C012BAE1C072D45722325ADD5B659EF3BD924E30848FBBDC0A5D5F202C19DBA34B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2