General

  • Target

    53bd1c4e038529351ecbb0c9e9732ae4.exe

  • Size

    168KB

  • Sample

    240111-y3vcxsgee7

  • MD5

    53bd1c4e038529351ecbb0c9e9732ae4

  • SHA1

    bb9347f3cb7bb059e5044a04eedd7298248fa054

  • SHA256

    03af286b101668c05339cee50d325f7f88d68f2948d7fa5c9e7dd3b068dab68b

  • SHA512

    7ca392c46245ea8be7e1079ffb7bc55caee7759cb5ed63629d580e28d046e33863c964c74be41824886b0982ecead87c66e63ec91c3848a7230d3cb2ed2d8aab

  • SSDEEP

    3072:dNQKPWDyPI00zJltZrpRARXd2izceWekjsrhvQ+Ic/2VEULQ590B:dNSDyPI/3thpodxQeWCRJ/29E9

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      53bd1c4e038529351ecbb0c9e9732ae4.exe

    • Size

      168KB

    • MD5

      53bd1c4e038529351ecbb0c9e9732ae4

    • SHA1

      bb9347f3cb7bb059e5044a04eedd7298248fa054

    • SHA256

      03af286b101668c05339cee50d325f7f88d68f2948d7fa5c9e7dd3b068dab68b

    • SHA512

      7ca392c46245ea8be7e1079ffb7bc55caee7759cb5ed63629d580e28d046e33863c964c74be41824886b0982ecead87c66e63ec91c3848a7230d3cb2ed2d8aab

    • SSDEEP

      3072:dNQKPWDyPI00zJltZrpRARXd2izceWekjsrhvQ+Ic/2VEULQ590B:dNSDyPI/3thpodxQeWCRJ/29E9

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • UAC bypass

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks