Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.5172dbebff40b5cd41fa0
  • Size 1012KB
  • SHA256 9a39e5fa0a6e7b3366a16367d5d87f11d26385a3c0d33e2d25f82b96d01f101b
  • MD5 a8e492c311b5172dbebff40b5cd41fa0
  • SHA1 fc1f285493b8c56d06269ead5b53172c307be4d7
  • SHA512 6c40b608bbabfdad90297c9486d28b73ef3e897f5f1a02de9412f525aaa9354bb6d1f8203a9db9916ffe1143be4ac6eb849a9d212f10ad5542157ea29c02a211
  • SSDEEP 12288:k1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0INK4h1oWxJpcEi0/3IWV//7cSd+ryZVX:k1/aGLDCM4D8ayGM0R3o8/aW3cQ
  • TLSH
    T10A254C7317C60DE7CB96E374918717BE9B309D264402DFEB9240892EABE3683695170F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2