Overview

overview

10

Static

static

91bb798720...fb.exe

windows7-x64

10

91bb798720...fb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    91bb7987205cf15e8d0aae7d4b70e4fb

  • Size

    364KB

  • Sample

    220825-yyrfgabbh5

  • MD5

    91bb7987205cf15e8d0aae7d4b70e4fb

  • SHA1

    e3df834c264b571cfcc6ea59b5c3300c1f0b6e50

  • SHA256

    97aad989c4f34380111fb132b7827627620daf276d3770e8eb2fcb095c69d620

  • SHA512

    8d244b955f492fd86db7843afed1f44dc2c571df893050caeccb2d26c6483b281ba47a03ca9bebe7323d84ed7bbea020d19ec1a4809c354726ab4fe56627e3f9

  • SSDEEP

    6144:EyH7xOc6H5c6HcT66vlml/SI01Jq3ggxDDwCkTTgP2Vi5wf5kueMQSdTJtBurgIP:EagCkDIZRk6zdTDEroI5

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      91bb7987205cf15e8d0aae7d4b70e4fb

    • Size

      364KB

    • MD5

      91bb7987205cf15e8d0aae7d4b70e4fb

    • SHA1

      e3df834c264b571cfcc6ea59b5c3300c1f0b6e50

    • SHA256

      97aad989c4f34380111fb132b7827627620daf276d3770e8eb2fcb095c69d620

    • SHA512

      8d244b955f492fd86db7843afed1f44dc2c571df893050caeccb2d26c6483b281ba47a03ca9bebe7323d84ed7bbea020d19ec1a4809c354726ab4fe56627e3f9

    • SSDEEP

      6144:EyH7xOc6H5c6HcT66vlml/SI01Jq3ggxDDwCkTTgP2Vi5wf5kueMQSdTJtBurgIP:EagCkDIZRk6zdTDEroI5

    Score
    10/10
    salitybackdoorupxevasiontrojan

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Modify Registry

5
T1112

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks