Overview

overview

10

Static

static

9d2bf81a1c...21.exe

windows7_x64

10

9d2bf81a1c...21.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d2bf81a1c12ce0af2cbc793fb96e7c59ecb917151827fefcdf814a8630c8a21

  • Size

    1.1MB

  • Sample

    220604-xg5fbsbfe7

  • MD5

    0e7945c912e4bd2d0c2395ebc70b9b00

  • SHA1

    760a83093f7d1c06a287a8712ad207a64787b53f

  • SHA256

    9d2bf81a1c12ce0af2cbc793fb96e7c59ecb917151827fefcdf814a8630c8a21

  • SHA512

    02727f863ea2668396e760ac60d7bd5cce3ac15e4129927a1c8c4de97b4c4664ff7a36dde834557825795b80a1a383dde5b0fd944a05300a637a1800023d0305

Score
10/10
salitybackdoorevasionpersistencetrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

http://klkjwre77638dfqwieuoi888.info/

Targets

    • Target

      9d2bf81a1c12ce0af2cbc793fb96e7c59ecb917151827fefcdf814a8630c8a21

    • Size

      1.1MB

    • MD5

      0e7945c912e4bd2d0c2395ebc70b9b00

    • SHA1

      760a83093f7d1c06a287a8712ad207a64787b53f

    • SHA256

      9d2bf81a1c12ce0af2cbc793fb96e7c59ecb917151827fefcdf814a8630c8a21

    • SHA512

      02727f863ea2668396e760ac60d7bd5cce3ac15e4129927a1c8c4de97b4c4664ff7a36dde834557825795b80a1a383dde5b0fd944a05300a637a1800023d0305

    Score
    10/10
    salitybackdoorevasionpersistencetrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks