Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.7cfdb6ff33db3306718e0
  • Size 1012KB
  • SHA256 22765a845179f76282319362069ea5f86d3f6ad94643adb408dfd90061af3836
  • MD5 c7485ed1fe77cfdb6ff33db3306718e0
  • SHA1 f84f317cc466667c9528644e6ae09d1c24b9646f
  • SHA512 26424e49d18536abaf376e7a31a18e291d6524f4f1d78c7274e9f720207b7b1b30c80cd16681690908560f35ac1262fc7296d736f45f4edfe12ce17c3c0d967d
  • SSDEEP 24576:k1/aGLDCM4D8ayGM0R3o8/0mK4aHUquZ2U2bI9ZQD:3D8ayGM0Zo/mK4mvU2bI9Z0
  • TLSH
    T131256C63197B0EBAC8A627B081831776B334BDB1D553C75DD250DE3EAAFB4C0AA19311
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2