Extracted

• • Target
    jaffacakes118_Virus.Win32.Sality.gen.6b3fdfaf14883e6ecef70
  • Size 138KB
  • SHA256 303b8d30c5f0fb54584c65a4f98cfd155ce4cab2b331833225b4fa5f24b8df5b
  • MD5 39d23f516526b3fdfaf14883e6ecef70
  • SHA1 cadb884d5ece0fbaae569065dbb9124cc42b12f4
  • SHA512 296f0a6cdab6d880953629c09da9ea11b13acf3c129de6b3479899c1b5cc416ff5dabf1260995fa84f9c7a82543ea76ecbf64eb77150146264d620f4eedfd32a
  • SSDEEP 3072:jIIsr6l9fzYgxryw2DFX5n2C9b5MwHxfaV:lsiLHr652C9N5Rfi
  • TLSH
    T1A8D3E0137AE68473FD45577045AA8607AF33BA000BB595DB4F98094FDEA23D06B3E392
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoverysalityupxdefense_evasiontrojan

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2