Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.807b45df92007714c5a20
  • Size 1012KB
  • SHA256 185ea6421c59f190a0f6cad7998066854d939b8fe54a037a3a3981159a5dbf05
  • MD5 a8dc4fd73a9807b45df92007714c5a20
  • SHA1 74e873a16bcdb900f2e55bda9d865389ff061e05
  • SHA512 1632e38d17cfb508def2ec04ae96904f1668d128590995bb1149e83dbbdb1fbe971d699b58bee8993a3513fdf1d9db4f2795d0b5a42fa7789473197be5de7e36
  • SSDEEP 24576:k1/aGLDCM4D8ayGM0R3o8/FhBpO0dbkahRt7SBCa6oNJXn+mVfqznvDXq4hLz1mi:3D8ayGM0ZoghBpXkahRt7SBCa6oNJXnS
  • TLSH
    T158255B4362CB4CEAD9D323F480832277A3F4AD740956975B6683CD26DAAF6C76F16301
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2