Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.1f520779af7e16c4c0c70
  • Size 97KB
  • SHA256 f4eee23688c65201b0d596d786488f415a25d3832ae8f5912e4583076eeae7d2
  • MD5 f5bddf3e34c1f520779af7e16c4c0c70
  • SHA1 80bfab9c4852946290122cb33989a4cf51c05c52
  • SHA512 7ce441dda1b270582f4e0e91884f43f030e8802aff1433fd5c0e339de51337995b36686cc33c1ab936e8bc199f4c438a9730e0a643c15f109641b61e6e7e851c
  • SSDEEP 1536:F8XS0Or+qKq0bR1DkkJ4/hoLtmlezY9sRwrDZ+3aRdeEmw:FRTr+F1NjRxU+3a+y
  • TLSH
    T105A31297111646F4D2B4A17F7BA0C70FC7519732A3701C8E9CFA87BAB5B5E1CA1A5009
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2