Overview

overview

10

Static

static

10

b8e9f7d114...fc.exe

windows7-x64

10

b8e9f7d114...fc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b8e9f7d1147deb787808909ba9684b5c0cefbb42d5ad6405a575bed4a08da5fc

  • Size

    66KB

  • Sample

    221106-x4bfrsbcfj

  • MD5

    084e5fabbf1ace2999f592942b81d161

  • SHA1

    52f75ebe1597d46e509bbee07d714a7b4801a6a6

  • SHA256

    b8e9f7d1147deb787808909ba9684b5c0cefbb42d5ad6405a575bed4a08da5fc

  • SHA512

    bb049ca3ba216c37f10c651213a67f179475f71226b1eaef7af962b168db1d1cb0bc07e64b30033df268f3a9315ec3577ca25dcf92f72aa94ee5651b9e4c5df7

  • SSDEEP

    1536:7ZRc3/dh4cJJQfZPcDK9h72AiaWpANy8:7wcjc27k

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      b8e9f7d1147deb787808909ba9684b5c0cefbb42d5ad6405a575bed4a08da5fc

    • Size

      66KB

    • MD5

      084e5fabbf1ace2999f592942b81d161

    • SHA1

      52f75ebe1597d46e509bbee07d714a7b4801a6a6

    • SHA256

      b8e9f7d1147deb787808909ba9684b5c0cefbb42d5ad6405a575bed4a08da5fc

    • SHA512

      bb049ca3ba216c37f10c651213a67f179475f71226b1eaef7af962b168db1d1cb0bc07e64b30033df268f3a9315ec3577ca25dcf92f72aa94ee5651b9e4c5df7

    • SSDEEP

      1536:7ZRc3/dh4cJJQfZPcDK9h72AiaWpANy8:7wcjc27k

    Score
    10/10
    salitybackdoorevasiontrojanupx

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks