Overview

overview

10

Static

static

cfe80d1db2...5f.exe

windows7-x64

10

cfe80d1db2...5f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cfe80d1db214d0d22388c88616b1737aa90a8fc382bb6c9c1eea702d7d44b25f

  • Size

    160KB

  • Sample

    221010-3ftkbsebek

  • MD5

    688527ff3e02205885d849cd413ed6d0

  • SHA1

    1060d5257fa97fc1d97a9a571f3cf41b1ff8ad59

  • SHA256

    cfe80d1db214d0d22388c88616b1737aa90a8fc382bb6c9c1eea702d7d44b25f

  • SHA512

    5863453f3d4f21901046689656bc7a64c77121941385aaccb62600f0a388ec613d83318688273af0201b760868558b330adcaf44feb3a08d90772692d956b496

  • SSDEEP

    3072:pnxwgxgfR/DVG7wBpEKzW38XhlKGNlG4BPdfshu:p+xDVG0BplWQTHfss

Score
10/10
salitybackdoorevasionpersistencetrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      cfe80d1db214d0d22388c88616b1737aa90a8fc382bb6c9c1eea702d7d44b25f

    • Size

      160KB

    • MD5

      688527ff3e02205885d849cd413ed6d0

    • SHA1

      1060d5257fa97fc1d97a9a571f3cf41b1ff8ad59

    • SHA256

      cfe80d1db214d0d22388c88616b1737aa90a8fc382bb6c9c1eea702d7d44b25f

    • SHA512

      5863453f3d4f21901046689656bc7a64c77121941385aaccb62600f0a388ec613d83318688273af0201b760868558b330adcaf44feb3a08d90772692d956b496

    • SSDEEP

      3072:pnxwgxgfR/DVG7wBpEKzW38XhlKGNlG4BPdfshu:p+xDVG0BplWQTHfss

    Score
    10/10
    salitybackdoorevasionpersistencetrojanupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks