sality | 1741a5140686cf2234ed0e2734c240aeec8a86923c0a544ce35c2716ef6e0cf8

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2022 23:38

Target

1741a5140686cf2234ed0e2734c240aeec8a86923c0a544ce35c2716ef6e0cf8.exe
Size

181KB
MD5

7d361d4091c567d2df272cedaab75900
SHA1

cb25d11cfd5ffb34056f6a16db0391ec2956fceb
SHA256

1741a5140686cf2234ed0e2734c240aeec8a86923c0a544ce35c2716ef6e0cf8
SHA512

d8deca9641fa0762d5d6e127c94349934e8169f6c424859984185cdca6f72b86a7934c3fb5223011a1d15090d63924b3e40763d15c702327729a38baadcdb862
SSDEEP

3072:nq/fSpAbGTe2Aq/tqiqqim8SZGr3X2IPzHWhAhud9M1g1A:nqoAbgeHrmDKw0uHF1A

Score

10^/10

sality backdoor upx

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/4288-132-0x00000000022C0000-0x000000000334E000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\1741a5140686cf2234ed0e2734c240aeec8a86923c0a544ce35c2716ef6e0cf8.exe
"C:\Users\Admin\AppData\Local\Temp\1741a5140686cf2234ed0e2734c240aeec8a86923c0a544ce35c2716ef6e0cf8.exe"
1⤵
PID:4288

memory/4288-132-0x00000000022C0000-0x000000000334E000-memory.dmp

Filesize
16.6MB

Download
memory/4288-133-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download