Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.439a72cade77423cd0370
  • Size 1012KB
  • SHA256 ee0bd7ad3b5b72acac75a1c92eeecdae039559fadb70a01d922314a20ee4f037
  • MD5 bbc60647b65439a72cade77423cd0370
  • SHA1 bd2d3532eea1161bf5c33f72968860ca3750f4d1
  • SHA512 16fd84c4dae38ff796b7ae8cb2aae2071745792ecc7bcad98625b83d4bdc7fe48b64c952e85647af4a6f6868fff8bf3a55138d69b3b497e6a3603ff331e169c6
  • SSDEEP 24576:k1/aGLDCM4D8ayGM0R3o8/nvdvJC2zyK9Z:3D8ayGM0Zoqg2Gm
  • TLSH
    T102256D5239DA0CAFC85263B447930BFEA3345E24552BCF5696E0C82B8BBF6C12F59711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2