Overview

overview

10

Static

static

b7de05c202...37.exe

windows7-x64

10

b7de05c202...37.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    b7de05c202f4f3fe3cb0da046881c193ca27a63a4bb51cec5b7f2aa6a6b52437

  • Size

    168KB

  • Sample

    221203-m84m1ahe4x

  • MD5

    913a6bfca17e940efd2b71b61b8422c4

  • SHA1

    a09ded6937cdc682475e6343afccc20f93ef9481

  • SHA256

    b7de05c202f4f3fe3cb0da046881c193ca27a63a4bb51cec5b7f2aa6a6b52437

  • SHA512

    1849ea9fcf805ae9f6732539a40927581ac00651771d581d595f459d2abab8de5666a16df9036ccfa97d03fb1f0b0c1b57499e3a275ba79dfcc0f6b29eda24d7

  • SSDEEP

    3072:NdZPIf4J6rvsqNrOF4skXeXaJbNL8aBohO7Yt8dME51zdVHS3u3nY:NwfU6rvsXmXeKJG8odt9815VHS3u3Y

Score
10/10
salityxtremeratbackdoorevasionpersistenceratspywaretrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Extracted

Family

xtremerat

C2

maradona.no-ip.org

Targets

    • Target

      b7de05c202f4f3fe3cb0da046881c193ca27a63a4bb51cec5b7f2aa6a6b52437

    • Size

      168KB

    • MD5

      913a6bfca17e940efd2b71b61b8422c4

    • SHA1

      a09ded6937cdc682475e6343afccc20f93ef9481

    • SHA256

      b7de05c202f4f3fe3cb0da046881c193ca27a63a4bb51cec5b7f2aa6a6b52437

    • SHA512

      1849ea9fcf805ae9f6732539a40927581ac00651771d581d595f459d2abab8de5666a16df9036ccfa97d03fb1f0b0c1b57499e3a275ba79dfcc0f6b29eda24d7

    • SSDEEP

      3072:NdZPIf4J6rvsqNrOF4skXeXaJbNL8aBohO7Yt8dME51zdVHS3u3nY:NwfU6rvsXmXeKJG8odt9815VHS3u3Y

    Score
    10/10
    salityxtremeratbackdoorevasionpersistenceratspywaretrojanupx

    • Detect XtremeRAT payload

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks