sality | 989a744e429b783b985cc28d0f229da976421165c73c7e8d7a5aac76982dc0bd

Analysis

max time kernel
173s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 23:23

Target

989a744e429b783b985cc28d0f229da976421165c73c7e8d7a5aac76982dc0bd.exe
Size

273KB
MD5

3caa8755eeb5d5359b2a848b14e42f99
SHA1

a204efe0a4c4e0e952b42223c8c5c6dfbaafde90
SHA256

989a744e429b783b985cc28d0f229da976421165c73c7e8d7a5aac76982dc0bd
SHA512

b6d5dd86fa072101b9e7ec40bb63998a4eebc11426b4ebca61a41386ce5250d13489f02454e88b7e05318ddb51047c200cfb12c6fa7ab1af85c0c43c0ab07fd2
SSDEEP

6144:B7gKNkhSR/5kHouyXnZhB+R8WHBHnzdYC+ps4J:B7gKNkhm/JuyXnPB+R8WH1p9ssK

Score

10^/10

sality backdoor upx

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/444-1-0x00000000021C0000-0x000000000327A000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\989a744e429b783b985cc28d0f229da976421165c73c7e8d7a5aac76982dc0bd.exe
"C:\Users\Admin\AppData\Local\Temp\989a744e429b783b985cc28d0f229da976421165c73c7e8d7a5aac76982dc0bd.exe"
1⤵
PID:444

memory/444-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/444-1-0x00000000021C0000-0x000000000327A000-memory.dmp

Filesize
16.7MB

Download
memory/444-2-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download