sality | 24405fb022d37ec416eb77b8049958f2fe323e17d0a262d7d4826124bd016e3c

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 19:27

Target

24405fb022d37ec416eb77b8049958f2fe323e17d0a262d7d4826124bd016e3c.exe
Size

140KB
MD5

3d7f5b84e63a3c10d6b50f6ab7aba446
SHA1

b42f20a2914868120c30ac7ee2e0f9edac381e9d
SHA256

24405fb022d37ec416eb77b8049958f2fe323e17d0a262d7d4826124bd016e3c
SHA512

f875e49bf2dd672df2484513847b70810c7b8bc9a6ec9e0a705576984bf8f3f9a4c079d10d937b062d803f47d79ccf84d7bcf89b7af85148ddf3f2dfaae5f250
SSDEEP

3072:Puug15q6gVLypcUwA+7vIQV4DZvfc8ELxXwm8ATlpeTEJ:Pu5gVLyo7vIQCvf7EdgJE

Score

10^/10

sality backdoor upx

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4828-132-0x0000000002160000-0x00000000031EE000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\24405fb022d37ec416eb77b8049958f2fe323e17d0a262d7d4826124bd016e3c.exe
"C:\Users\Admin\AppData\Local\Temp\24405fb022d37ec416eb77b8049958f2fe323e17d0a262d7d4826124bd016e3c.exe"
1⤵
PID:4828

memory/4828-133-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4828-132-0x0000000002160000-0x00000000031EE000-memory.dmp

Filesize
16.6MB

Download
memory/4828-134-0x0000000002160000-0x00000000031EE000-memory.dmp

Filesize
16.6MB

Download