sality | 6d21ac4fa0ad2b06732bb552a7b463296c0e7334a951c9ce41ea3be52889b9f0

Analysis

max time kernel
136s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/01/2024, 10:32

Target

6d21ac4fa0ad2b06732bb552a7b463296c0e7334a951c9ce41ea3be52889b9f0.exe
Size

1.5MB
MD5

c1a5cddd739c5a3f79fc34ac326a70b3
SHA1

7b63531a2bd02bf9dc6ea40507e7f00d863ae68b
SHA256

6d21ac4fa0ad2b06732bb552a7b463296c0e7334a951c9ce41ea3be52889b9f0
SHA512

0650f6d2a940b39ab080762b85984660f88ab9c8ceb4aaa5771cd215ae0e54ffd4b776b7490c333d4f0cb4e3d340c81ef361ef7863e6b350e57a68c929870b8d
SSDEEP

24576:5rKbF0JCH8y+x3ddpnCGzLtjvlPBqnT91Q17zp74NQQZNZRfKRDeZ:5rKbmwgl1BjNZqnTzQ17ziNQQZNZRfKW

Score

10^/10

sality backdoor upx

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4636-1-0x0000000002540000-0x00000000035FA000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\6d21ac4fa0ad2b06732bb552a7b463296c0e7334a951c9ce41ea3be52889b9f0.exe
"C:\Users\Admin\AppData\Local\Temp\6d21ac4fa0ad2b06732bb552a7b463296c0e7334a951c9ce41ea3be52889b9f0.exe"
1⤵
PID:4636

memory/4636-0-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download
memory/4636-1-0x0000000002540000-0x00000000035FA000-memory.dmp

Filesize
16.7MB

Download
memory/4636-2-0x0000000000400000-0x0000000000575000-memory.dmp

Filesize
1.5MB

Download