Overview

overview

10

Static

static

118c9ba980...5e.exe

windows7_x64

10

118c9ba980...5e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    118c9ba98048159766fac4801ee747737bb77d87281cc27dd84d5caa8b93585e

  • Size

    2.3MB

  • Sample

    220604-davsrsegd7

  • MD5

    5cd0d7e9be0fce2ed64da3adf6cf11c7

  • SHA1

    c073ba7e50ec248469ed80bcb7202e2d4c402d18

  • SHA256

    118c9ba98048159766fac4801ee747737bb77d87281cc27dd84d5caa8b93585e

  • SHA512

    c356e3ed8e62c771ea5b927ff64a6cb7239b100abfb5c22bba47cb180d8e66fa65857b4edc4ffb54c8a4862ea257c33014b7ca0558d444636b468d895cfbf106

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

http://klkjwre77638dfqwieuoi888.info/

Targets

    • Target

      118c9ba98048159766fac4801ee747737bb77d87281cc27dd84d5caa8b93585e

    • Size

      2.3MB

    • MD5

      5cd0d7e9be0fce2ed64da3adf6cf11c7

    • SHA1

      c073ba7e50ec248469ed80bcb7202e2d4c402d18

    • SHA256

      118c9ba98048159766fac4801ee747737bb77d87281cc27dd84d5caa8b93585e

    • SHA512

      c356e3ed8e62c771ea5b927ff64a6cb7239b100abfb5c22bba47cb180d8e66fa65857b4edc4ffb54c8a4862ea257c33014b7ca0558d444636b468d895cfbf106

    Score
    10/10
    salitybackdoorevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks