Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.27e87af3be7d30a531540
  • Size 1012KB
  • SHA256 48e076e4476951872f706ee114d23e115bbc0f6926b083ec1575211601474803
  • MD5 ba9c7b8651427e87af3be7d30a531540
  • SHA1 1d39bd6c00ff1b1971849a24bb24bc8a38a1afe5
  • SHA512 31f14cb9e27fd9b6f116f5f1ceefb192db128473ce0b1fc84fd46e46aea73156c33f9b971225dcba851b51ab9af40ebb1f3cd4cbaf036dce8af2a0ead564542e
  • SSDEEP 24576:k1/aGLDCM4D8ayGM0R3o8/oLm6IeTnxB4NJBS:3D8ayGM0ZojLm4TnxBiJBS
  • TLSH
    T15E253A92D5A60CB5CF9223FC64CBEFB152345D25B11ED796878CC826A9A36F0F91C702
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2