Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.44cd441f547a3c1367560
  • Size 1.1MB
  • SHA256 7e523803d2401e931ee84b8ac12956e2ccaa14dfc3373e5fab7258b6578e1bb4
  • MD5 2a2aa67025644cd441f547a3c1367560
  • SHA1 0951bee557c7feed83c1587521c384f2338d0fcd
  • SHA512 916b99bc1e9798d6e17e0d0b67bc3653f25afd4f47e8a40f8917be16e7f0e4b180ecdd0a4fc853f0461e800de270005068d06b8668b96059f714d5a7204c79c8
  • SSDEEP 24576:W1/aGLDCM4D8ayGMCPnXo8/SbeSqjdqs8OnU:FD8ayGM0Xouk
  • TLSH
    T1D5356C5276CA19B5C8A273746143F7B2E338AD21492FC75A9A84C83ADFB31C57B1930D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2