sality | a90a857bb89934a56f667e35fbe85f185ec38e30d0cab907d104219f428b681c

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 08:34

Target

a90a857bb89934a56f667e35fbe85f185ec38e30d0cab907d104219f428b681c.exe
Size

566KB
MD5

131472f0dd4cc0b403b0ead9816c31f0
SHA1

5203abb210ebc74fb154d03b596820546c16a25f
SHA256

a90a857bb89934a56f667e35fbe85f185ec38e30d0cab907d104219f428b681c
SHA512

f31d8078defccc7770fb4d85e7d174d66bf78f1557dbabcb3f2ee165a3ea5bf515ec2fe1ef2dea567f6c76a6b44f77b63727cf85ff9a68d3c99d6333f4369f1a
SSDEEP

6144:PEg68/AnUYy2apPYLSifwIx8tVTFUs82tppPKUKtA6BGOBiU+s:PEM4nU2AgLFSLfmtA07MU+

Score

10^/10

sality backdoor upx

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4360-133-0x0000000002240000-0x00000000032FA000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\a90a857bb89934a56f667e35fbe85f185ec38e30d0cab907d104219f428b681c.exe
"C:\Users\Admin\AppData\Local\Temp\a90a857bb89934a56f667e35fbe85f185ec38e30d0cab907d104219f428b681c.exe"
1⤵
PID:4360

memory/4360-132-0x000000002E000000-0x000000002E090000-memory.dmp

Filesize
576KB

Download
memory/4360-133-0x0000000002240000-0x00000000032FA000-memory.dmp

Filesize
16.7MB

Download
memory/4360-134-0x000000002E000000-0x000000002E090000-memory.dmp

Filesize
576KB

Download