General

  • Target

    a9c3b063c6e5162d899afc8c16462f5b44188716062512475b5b6fd78e72374b

  • Size

    805KB

  • Sample

    240326-3eve8shf9t

  • MD5

    01f914b0b063459c60a9f4f999dd544a

  • SHA1

    bfbecf58e280252ea45c14308186933977ce3055

  • SHA256

    a9c3b063c6e5162d899afc8c16462f5b44188716062512475b5b6fd78e72374b

  • SHA512

    c922fda797ba396d0c3d438bc84c2a4e5c0971da0ad4a7e46dcd1f92221f4d8969211cd1014692d93a4c69dadb7d86ec8a1ae878ce88822e23156a2a88e34a3e

  • SSDEEP

    12288:9EAHydNBm+IY1wYPiwMeHlg3p6IBoYlkGc3ZIv:9EAHuNhIaXMeFgZGYu0

Score
10/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      a9c3b063c6e5162d899afc8c16462f5b44188716062512475b5b6fd78e72374b

    • Size

      805KB

    • MD5

      01f914b0b063459c60a9f4f999dd544a

    • SHA1

      bfbecf58e280252ea45c14308186933977ce3055

    • SHA256

      a9c3b063c6e5162d899afc8c16462f5b44188716062512475b5b6fd78e72374b

    • SHA512

      c922fda797ba396d0c3d438bc84c2a4e5c0971da0ad4a7e46dcd1f92221f4d8969211cd1014692d93a4c69dadb7d86ec8a1ae878ce88822e23156a2a88e34a3e

    • SSDEEP

      12288:9EAHydNBm+IY1wYPiwMeHlg3p6IBoYlkGc3ZIv:9EAHuNhIaXMeFgZGYu0

    Score
    10/10
    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

    • UPX dump on OEP (original entry point)

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Matrix

Tasks