Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.3a1186ec4c8bbf82bcfd0
  • Size 1.1MB
  • SHA256 4851580c9083b6df16214c34de5fc3219bc8ef745450ebabc52f71e29374c38e
  • MD5 b1d6bdc57463a1186ec4c8bbf82bcfd0
  • SHA1 e70d3241ad95731ebffa16c9251c818167c6da75
  • SHA512 1d0f9abf33f1b35977788069438fc5a213f8e60205dfb00380d11f843e8d456eb62fd90e2515873f42a3c78089f2ae8bf62764f51c8d0e11128b4ad3a285f76d
  • SSDEEP 12288:W1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0crPxVcEoWxJpcEi0/3IWV//7cSdqfSen:W1/aGLDCM4D8ayGMCPnXo8/OS8FLXpfX
  • TLSH
    T1A6355B637F8A0DFACC9236F0919317B5933898664123975B9744CE2AAE93FC3AD17701
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2