Overview

overview

10

Static

static

8

b76da23dea...4f.exe

windows7-x64

8

b76da23dea...4f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b76da23dea67bc4cb0823850db8c8c026d72d518d69927ca989635b7fdec3c4f

  • Size

    107KB

  • Sample

    221002-eml7tsgca4

  • MD5

    6e85d7a76a192004c52c329fbae1009f

  • SHA1

    a913a5763fabf5502e931439d9e1fa77d6e967dc

  • SHA256

    b76da23dea67bc4cb0823850db8c8c026d72d518d69927ca989635b7fdec3c4f

  • SHA512

    aa3841e00bdbc37b2072ff913d73e2853048d175a26155caf77621f853d97f6b235bc0e3cb34cb7a286cc8816a87bfa5130fcab4d7e8d370080b388898fba7be

  • SSDEEP

    3072:Vb3txnVZhJVsb2GYA2dJrnk07qYiQSLD0GGm1N:ZLDVKYzFkYiQSnm8

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      b76da23dea67bc4cb0823850db8c8c026d72d518d69927ca989635b7fdec3c4f

    • Size

      107KB

    • MD5

      6e85d7a76a192004c52c329fbae1009f

    • SHA1

      a913a5763fabf5502e931439d9e1fa77d6e967dc

    • SHA256

      b76da23dea67bc4cb0823850db8c8c026d72d518d69927ca989635b7fdec3c4f

    • SHA512

      aa3841e00bdbc37b2072ff913d73e2853048d175a26155caf77621f853d97f6b235bc0e3cb34cb7a286cc8816a87bfa5130fcab4d7e8d370080b388898fba7be

    • SSDEEP

      3072:Vb3txnVZhJVsb2GYA2dJrnk07qYiQSLD0GGm1N:ZLDVKYzFkYiQSnm8

    Score
    10/10
    upxsalitybackdoorevasiontrojan

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks