Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.968751ada0136c95697b0
  • Size 1012KB
  • SHA256 8f6fa59c07cb7c06b4e3d2284b0616043419364681cc7a8cb56b655b5661c639
  • MD5 af324cdf0ce968751ada0136c95697b0
  • SHA1 724c909437e66f49b276a8f21f44165aa2e56f50
  • SHA512 0d3c7fc135fb061b7ada579d386ed88cbd8d3b9600a103b8f2e86202ab5b966123ea6d89f80416d0b7211dcf264748eb69e900d178a8530a2db023791e7035be
  • SSDEEP 24576:k1/aGLDCM4D8ayGM0R3o8/u3lAuYII6ZazEthendo3fGolqp0/QS17HW1S36gQ54:3D8ayGM0Zox3lAuYIbZazEthendo3fGQ
  • TLSH
    T177256D53578A0CB6C89E2BB455A727766338EC35C5128B7A62CCC4269EB7FCD6D0DB00
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2