Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.27112a321c4347e1959d0
  • Size 1012KB
  • SHA256 575a22f9df4ff7679158fbcf2c819a6a8f3ba5a831ef5bc5f9001c038e4581f5
  • MD5 b03fa22227927112a321c4347e1959d0
  • SHA1 62ae7e14a77776510503db1d607b6911cf71f353
  • SHA512 6dea06630848922f8a85ca5676e522c1706498d08c1aad153274e5e04c3be212eb0390c7989d1b12517057e73853fd27983febbe5256bf0098149b119c28aaa4
  • SSDEEP 12288:k1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0INK4h1oWxJpcEi0/3IWV//7cSd465Q9d:k1/aGLDCM4D8ayGM0R3o8/A9fjLT71/
  • TLSH
    T1E3256B116A8B0CE1DDE713F49D870FA697789D348416FBA65703D926ABA32A07DF4330
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2