Overview

overview

10

Static

static

4155cd552d...92.exe

windows7-x64

3

4155cd552d...92.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4155cd552dc2f3e56f32423aaeadb6a9f5ac0c14576d9b1d0d03391b8b11a592

  • Size

    99KB

  • Sample

    221123-vs5jcscg91

  • MD5

    43cf1f3348e6aa533975a021fa055621

  • SHA1

    7a997551427ccb4c5615d920afc103b8ebdc34d9

  • SHA256

    4155cd552dc2f3e56f32423aaeadb6a9f5ac0c14576d9b1d0d03391b8b11a592

  • SHA512

    41b2217e8fa6f25e797240ffb4ffffbd1b3ec2c6b460edc5658ff3a43b8a0de21217417bc1fb4cb3b1393c16362c169c2b0a0d9255105e7d281c45e5a6f3e9ac

  • SSDEEP

    1536:h3A7XPDUAZeig2OHbm0CjbusSCnroMihUA3nceNNeihj3zwziZjvCd1EdMo:h3cPDU8Vg2bLalZgW0iv

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      4155cd552dc2f3e56f32423aaeadb6a9f5ac0c14576d9b1d0d03391b8b11a592

    • Size

      99KB

    • MD5

      43cf1f3348e6aa533975a021fa055621

    • SHA1

      7a997551427ccb4c5615d920afc103b8ebdc34d9

    • SHA256

      4155cd552dc2f3e56f32423aaeadb6a9f5ac0c14576d9b1d0d03391b8b11a592

    • SHA512

      41b2217e8fa6f25e797240ffb4ffffbd1b3ec2c6b460edc5658ff3a43b8a0de21217417bc1fb4cb3b1393c16362c169c2b0a0d9255105e7d281c45e5a6f3e9ac

    • SSDEEP

      1536:h3A7XPDUAZeig2OHbm0CjbusSCnroMihUA3nceNNeihj3zwziZjvCd1EdMo:h3cPDU8Vg2bLalZgW0iv

    Score
    10/10
    salitybackdoorevasiontrojanupx

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Modify Registry

4
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks