Overview

overview

10

Static

static

e6499ae93f...62.exe

windows7-x64

10

e6499ae93f...62.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e6499ae93f94591837359fce76b09c36f3e225fab2c5e7deed7952845da3ea62

  • Size

    915KB

  • Sample

    221011-yh8d2sbfg2

  • MD5

    88a0f2edb12c0a743f4484c3f39ac657

  • SHA1

    a583f31f0ff29fd4691db64439f7583493ca7e6e

  • SHA256

    e6499ae93f94591837359fce76b09c36f3e225fab2c5e7deed7952845da3ea62

  • SHA512

    294ed9ae14f29f7bad0d936fc18e9a69dce18be4ea3366c88616d02f2b6ed970e20605e964b2ce47e643daab1454f55bedb94e1a1a611926e8a6c88c58ff0d56

  • SSDEEP

    24576:tzYXUYI1yIjq93FTwxKZ1t6aeWgSCI0QDHKH:yk9ovVTwy1t6aeJtPJ

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      e6499ae93f94591837359fce76b09c36f3e225fab2c5e7deed7952845da3ea62

    • Size

      915KB

    • MD5

      88a0f2edb12c0a743f4484c3f39ac657

    • SHA1

      a583f31f0ff29fd4691db64439f7583493ca7e6e

    • SHA256

      e6499ae93f94591837359fce76b09c36f3e225fab2c5e7deed7952845da3ea62

    • SHA512

      294ed9ae14f29f7bad0d936fc18e9a69dce18be4ea3366c88616d02f2b6ed970e20605e964b2ce47e643daab1454f55bedb94e1a1a611926e8a6c88c58ff0d56

    • SSDEEP

      24576:tzYXUYI1yIjq93FTwxKZ1t6aeWgSCI0QDHKH:yk9ovVTwy1t6aeJtPJ

    Score
    10/10
    salitybackdoorevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks