Overview

overview

10

Static

static

3

NEAS.d5484...70.exe

windows7-x64

10

NEAS.d5484...70.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.d5484526d9a921dafd208fda97ff5870.exe

  • Size

    65KB

  • Sample

    231021-1eecxabg44

  • MD5

    d5484526d9a921dafd208fda97ff5870

  • SHA1

    01b5b2bfe41fc599fd106b1d11ec5b23fd23ae7f

  • SHA256

    bd1089943bfee3b25513621c7cf198c7c06630a4d5ddfede89ecfab8f2f2f4af

  • SHA512

    2012890fb750f999bb76d0ef981520f3ccee9fbd4cac0979609bbcec16c6ee0b01d0a02eaa9847859517bba50107d8d57c37902266ead34d5722760d715b0b99

  • SSDEEP

    1536:q4XgOMjFfDWPIL47VseqKcIEFjrBbAOwqecF3s9UGYirLAQmzTi:/OjZDWPIgCeqPDBbUcF3suyLRmzTi

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      NEAS.d5484526d9a921dafd208fda97ff5870.exe

    • Size

      65KB

    • MD5

      d5484526d9a921dafd208fda97ff5870

    • SHA1

      01b5b2bfe41fc599fd106b1d11ec5b23fd23ae7f

    • SHA256

      bd1089943bfee3b25513621c7cf198c7c06630a4d5ddfede89ecfab8f2f2f4af

    • SHA512

      2012890fb750f999bb76d0ef981520f3ccee9fbd4cac0979609bbcec16c6ee0b01d0a02eaa9847859517bba50107d8d57c37902266ead34d5722760d715b0b99

    • SSDEEP

      1536:q4XgOMjFfDWPIL47VseqKcIEFjrBbAOwqecF3s9UGYirLAQmzTi:/OjZDWPIgCeqPDBbUcF3suyLRmzTi

    Score
    10/10
    salitybackdoorevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks