Overview

overview

10

Static

static

8

a6b4518d4f...7c.exe

windows7-x64

10

a6b4518d4f...7c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a6b4518d4fe63022c6637ee9a1be5c52d5f410ccffef615857691d80af6a3a7c

  • Size

    135KB

  • Sample

    221011-kvarnaehg9

  • MD5

    63ad30b98c976717941b784f75eec2c0

  • SHA1

    fcf7714969ccffb0492117851e5083b9f278af5a

  • SHA256

    a6b4518d4fe63022c6637ee9a1be5c52d5f410ccffef615857691d80af6a3a7c

  • SHA512

    b510f2bc92be91fac09eca8e183313dc690df21894e3627fe1996a2d28de4f83856b847417b4692bbe4310c73b614ffb1c575efa2a4be3e7a46cce18075662b2

  • SSDEEP

    3072:QNqMDUcnvXSj2wa2WI0oUSTRtWfcV64SsEE1URZANuZ7k:qqkUcnv0tfbTVCE1UUNuRk

Score
10/10
salitybackdoorevasionpersistencetrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

http://klkjwre77638dfqwieuoi888.info/

Targets

    • Target

      a6b4518d4fe63022c6637ee9a1be5c52d5f410ccffef615857691d80af6a3a7c

    • Size

      135KB

    • MD5

      63ad30b98c976717941b784f75eec2c0

    • SHA1

      fcf7714969ccffb0492117851e5083b9f278af5a

    • SHA256

      a6b4518d4fe63022c6637ee9a1be5c52d5f410ccffef615857691d80af6a3a7c

    • SHA512

      b510f2bc92be91fac09eca8e183313dc690df21894e3627fe1996a2d28de4f83856b847417b4692bbe4310c73b614ffb1c575efa2a4be3e7a46cce18075662b2

    • SSDEEP

      3072:QNqMDUcnvXSj2wa2WI0oUSTRtWfcV64SsEE1URZANuZ7k:qqkUcnv0tfbTVCE1UUNuRk

    Score
    10/10
    salitybackdoorevasionpersistencetrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks