sality | 109addbd116fbee828b5da267d55dfbb43a40ae11222be4c80a2c2742152e205

Analysis

max time kernel
129s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 03:00

Target

109addbd116fbee828b5da267d55dfbb43a40ae11222be4c80a2c2742152e205.exe
Size

181KB
MD5

80277703667ef3078fb8177719629f60
SHA1

ad22f27da815e10525cf4832721433404936edb1
SHA256

109addbd116fbee828b5da267d55dfbb43a40ae11222be4c80a2c2742152e205
SHA512

54eec88ccc2a61b29d33b91fbf0f777a9c933545236fa9b2d29a7db64640d8a1de2b4a6e8d830020e2ca9e6adb72adb6419bbe7450cba61af95e07915375b08f
SSDEEP

3072:hB89lEpGaJUo89EhEPptMe7ci4zjSkQsLf5CJf:hB7YIkWlKsLf4d

Score

10^/10

sality backdoor upx

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2220-133-0x0000000002450000-0x00000000034DE000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\109addbd116fbee828b5da267d55dfbb43a40ae11222be4c80a2c2742152e205.exe
"C:\Users\Admin\AppData\Local\Temp\109addbd116fbee828b5da267d55dfbb43a40ae11222be4c80a2c2742152e205.exe"
1⤵
PID:2220

memory/2220-132-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2220-133-0x0000000002450000-0x00000000034DE000-memory.dmp

Filesize
16.6MB

Download
memory/2220-134-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download