Overview

overview

10

Static

static

3

01b33cd330...59.exe

windows7-x64

10

01b33cd330...59.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    01b33cd3304bbf320de06b217770cc59

  • Size

    272KB

  • Sample

    231225-dkjs9afbfj

  • MD5

    01b33cd3304bbf320de06b217770cc59

  • SHA1

    d949ed9ceb79e9d9cf959ce8894b0371e8f4f584

  • SHA256

    52b31ea74ab60aa7722acdb4380db969be2a144594a682802422c6653813e91e

  • SHA512

    14df26cd6011e56ece2f44fe08184e0e99638c1c85a664718498d58666c322a35dc918dbb83aa04f459d93aa9410db30b711fd08e57e02e18000a49bd6103a10

  • SSDEEP

    3072:Obmq6P2+0nxpUKhtKvUYxNTRBUw+d9lXBoZ6d/TEAzrVNp887y3:ObMP2TnxsVRh+foS88W

Score
10/10
salityxtremeratbackdoorevasionpersistenceratspywaretrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Extracted

Family

xtremerat

C2

antonioxx.no-ip.org

Targets

    • Target

      01b33cd3304bbf320de06b217770cc59

    • Size

      272KB

    • MD5

      01b33cd3304bbf320de06b217770cc59

    • SHA1

      d949ed9ceb79e9d9cf959ce8894b0371e8f4f584

    • SHA256

      52b31ea74ab60aa7722acdb4380db969be2a144594a682802422c6653813e91e

    • SHA512

      14df26cd6011e56ece2f44fe08184e0e99638c1c85a664718498d58666c322a35dc918dbb83aa04f459d93aa9410db30b711fd08e57e02e18000a49bd6103a10

    • SSDEEP

      3072:Obmq6P2+0nxpUKhtKvUYxNTRBUw+d9lXBoZ6d/TEAzrVNp887y3:ObMP2TnxsVRh+foS88W

    Score
    10/10
    salityxtremeratbackdoorevasionpersistenceratspywaretrojanupx

    • Detect XtremeRAT payload

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks