Overview

overview

10

Static

static

01d7a26ea2...02.exe

windows7-x64

3

01d7a26ea2...02.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    01d7a26ea2ccd5465fd68129626d32f00cbb24348c56857cef81880c1512f302

  • Size

    216KB

  • Sample

    221030-1y82madebq

  • MD5

    a10c7eea8dad0d7c9b0ce4e032a0a130

  • SHA1

    50b565498d6e9c6916d06c279a6e975fd90c1ca4

  • SHA256

    01d7a26ea2ccd5465fd68129626d32f00cbb24348c56857cef81880c1512f302

  • SHA512

    5c13f3d7267b30b17ce7e558980f757f7776a431b6c379483024f79451bb3fdac30018916d16b365d9bc52ca5638b1cf67653bbb201608e42beda2f542d8d17d

  • SSDEEP

    3072:B6YgJesdiayxyvZcMO/6T4nIB5BAZldNrFPomTaMd8OEiMIL:K5dWAZcR/6TkINwl7rRP/8OE

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      01d7a26ea2ccd5465fd68129626d32f00cbb24348c56857cef81880c1512f302

    • Size

      216KB

    • MD5

      a10c7eea8dad0d7c9b0ce4e032a0a130

    • SHA1

      50b565498d6e9c6916d06c279a6e975fd90c1ca4

    • SHA256

      01d7a26ea2ccd5465fd68129626d32f00cbb24348c56857cef81880c1512f302

    • SHA512

      5c13f3d7267b30b17ce7e558980f757f7776a431b6c379483024f79451bb3fdac30018916d16b365d9bc52ca5638b1cf67653bbb201608e42beda2f542d8d17d

    • SSDEEP

      3072:B6YgJesdiayxyvZcMO/6T4nIB5BAZldNrFPomTaMd8OEiMIL:K5dWAZcR/6TkINwl7rRP/8OE

    Score
    10/10
    salitybackdoorevasiontrojanupx

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks