sality | 15791fd1120a9f506cef5582a299875a69c45b3d17ac86b5ec2c31ee7d5c8655

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231130-en
resource tags

arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
submitted
12-12-2023 13:02

Target

15791fd1120a9f506cef5582a299875a69c45b3d17ac86b5ec2c31ee7d5c8655.exe
Size

2.3MB
MD5

1de3e620fc8ce5a3518d8dea0fd90969
SHA1

86cd06ec282f22cecb2ba6dde9fc3b5886433ad9
SHA256

15791fd1120a9f506cef5582a299875a69c45b3d17ac86b5ec2c31ee7d5c8655
SHA512

0c5ce6f284d2812d5aa9059814d576d3b6d603ab182f5ab3bbc357b520a0f20ab6bf3bb4cf64cf13c714633ee190667f50c14a8d78b32aa1be7e8b0778a972ec
SSDEEP

49152:YB9aVB9lB9lB9EB99zB99B9LB9YYSuyrsj1XAn2rf36nIj0TwuNj:YHaVHlHlHEH9zH9HLHYYSuyrSg2rfqnV

Score

10^/10

sality backdoor upx

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2392-0-0x0000000002F90000-0x000000000401E000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\15791fd1120a9f506cef5582a299875a69c45b3d17ac86b5ec2c31ee7d5c8655.exe
"C:\Users\Admin\AppData\Local\Temp\15791fd1120a9f506cef5582a299875a69c45b3d17ac86b5ec2c31ee7d5c8655.exe"
1⤵
PID:2392

memory/2392-1-0x0000000000400000-0x0000000001259000-memory.dmp

Filesize
14.3MB

Download
memory/2392-0-0x0000000002F90000-0x000000000401E000-memory.dmp

Filesize
16.6MB

Download
memory/2392-2-0x0000000000400000-0x0000000001259000-memory.dmp

Filesize
14.3MB

Download