Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.004c0554907faf6e00f90
  • Size 1012KB
  • SHA256 2cf9968dc013a68dd4570206d44e7a3097eddf8ad1d7852970b5e08e05ada1b9
  • MD5 d4e7f0a478f004c0554907faf6e00f90
  • SHA1 86981d1ccfaa333f77e7f33a7871d6df3429656e
  • SHA512 9df2b4a826afcab61dc452f38862bda2d2ad331b8462562682932bcf3d9c3c429b5c6c5a5da78c04f209c72a0680ef22e8d186707796d4801eaef5d298e2c790
  • SSDEEP 24576:k1/aGLDCM4D8ayGM0R3o8/ZDl1D+UCcuJDoKEQDJk3h:3D8ayGM0ZoC+UCcu+KEQlk3h
  • TLSH
    T159256B172382CCE6C862E7F05D8737B5B738EE264907C776EE40F8269D632B26955321
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2