sality | f45421538ece6be6fe8bee9a4ab0c6d8354209b7e8fffff47745a46d4cc13456

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 08:19

Target

f45421538ece6be6fe8bee9a4ab0c6d8354209b7e8fffff47745a46d4cc13456.exe
Size

96KB
MD5

3b18fefa35cdeb7759b4c31eaf90ee01
SHA1

a977bf4e1dcab474d8125b6f8582096aaa3bed5f
SHA256

f45421538ece6be6fe8bee9a4ab0c6d8354209b7e8fffff47745a46d4cc13456
SHA512

894a95577e23a59880e6bba2792cec5e80f4f35c3072886d25941387a1364881b9b02af3d9e1cb48a61d81e4a8ca7cf797e04fbe0c0713a1187946af4dc57b7f
SSDEEP

1536:71oA0Q1pqBD8lfWMVymdf20jTg00O37Mol8cckGX:R5jqBD8lfWMVVR20nbrm5HX

Score

10^/10

sality backdoor upx

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3048-132-0x0000000002380000-0x000000000340E000-memory.dmp	upx

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3048	f45421538ece6be6fe8bee9a4ab0c6d8354209b7e8fffff47745a46d4cc13456.exe

C:\Users\Admin\AppData\Local\Temp\f45421538ece6be6fe8bee9a4ab0c6d8354209b7e8fffff47745a46d4cc13456.exe
"C:\Users\Admin\AppData\Local\Temp\f45421538ece6be6fe8bee9a4ab0c6d8354209b7e8fffff47745a46d4cc13456.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3048

memory/3048-132-0x0000000002380000-0x000000000340E000-memory.dmp

Filesize
16.6MB

Download
memory/3048-133-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download