Overview

overview

10

Static

static

8

3c96903992...1d.exe

windows7-x64

8

3c96903992...1d.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3c96903992a932e2d04d90fc12a9736206a15f2178e4c94e4e0e3d126976821d

  • Size

    204KB

  • Sample

    221011-gb8mssged7

  • MD5

    7caffe0875d9dda91c8c9bc68cfac579

  • SHA1

    8d0042278392bf894ddf7ccf8b450e85b821ff2a

  • SHA256

    3c96903992a932e2d04d90fc12a9736206a15f2178e4c94e4e0e3d126976821d

  • SHA512

    b185a9dd8ab4ba43ca5fc0fdab875c50d354c6424295d24513d10317ace000100c3e604b0b92c09a84bacfd86d2ff2ac9b36ec4eb8550d154a44a1e2be483173

  • SSDEEP

    6144:LlKwiFpGvjMAXwnDBzVF5BQho773dGFB1CQ3SzLFlR0rL:LUdsjMpnDdvTg9v3SzB03

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      3c96903992a932e2d04d90fc12a9736206a15f2178e4c94e4e0e3d126976821d

    • Size

      204KB

    • MD5

      7caffe0875d9dda91c8c9bc68cfac579

    • SHA1

      8d0042278392bf894ddf7ccf8b450e85b821ff2a

    • SHA256

      3c96903992a932e2d04d90fc12a9736206a15f2178e4c94e4e0e3d126976821d

    • SHA512

      b185a9dd8ab4ba43ca5fc0fdab875c50d354c6424295d24513d10317ace000100c3e604b0b92c09a84bacfd86d2ff2ac9b36ec4eb8550d154a44a1e2be483173

    • SSDEEP

      6144:LlKwiFpGvjMAXwnDBzVF5BQho773dGFB1CQ3SzLFlR0rL:LUdsjMpnDdvTg9v3SzB03

    Score
    10/10
    upxsalitybackdoorevasiontrojan

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks