sality | c8628db974d5c0c0e6d05d5e5c3fd8597d3e2806bef3e4a5998fefab0950d3f7

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 08:28

Target

c8628db974d5c0c0e6d05d5e5c3fd8597d3e2806bef3e4a5998fefab0950d3f7.exe
Size

178KB
MD5

309547bbe65f734f84e56cf195172f30
SHA1

e95ede4528c8cd5e830750e3d8a530703bdfe37c
SHA256

c8628db974d5c0c0e6d05d5e5c3fd8597d3e2806bef3e4a5998fefab0950d3f7
SHA512

9cd9a4a4ae41ff116568ebf811998ed9b4245b0c175c8496230565ce7dcd906ca4dba22b5a8c1bf3d4bf84f92a2d0d56639335ba1385f0f8a41af929a42ea683
SSDEEP

3072:PbeNNN2SHvMHfYn/1AkDfZpuCaviKxTBfKDATS4jTryUvNlutMxbmB7tap+IA:jecEvMHw2CfZpul6KxTByDATSsryuutT

Score

10^/10

sality backdoor upx

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2268-132-0x0000000002340000-0x00000000033FA000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\c8628db974d5c0c0e6d05d5e5c3fd8597d3e2806bef3e4a5998fefab0950d3f7.exe
"C:\Users\Admin\AppData\Local\Temp\c8628db974d5c0c0e6d05d5e5c3fd8597d3e2806bef3e4a5998fefab0950d3f7.exe"
1⤵
PID:2268

memory/2268-133-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2268-132-0x0000000002340000-0x00000000033FA000-memory.dmp

Filesize
16.7MB

Download