Overview

overview

10

Static

static

3

9ac782c1c0...30.exe

windows7-x64

10

9ac782c1c0...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ac782c1c0a23ad6a1092bdaaa78c17561335625446f438d7d934b49aa523930

  • Size

    132KB

  • Sample

    240330-1jbgtafh22

  • MD5

    8bd5d568d369a2879c839bdab44f29b9

  • SHA1

    214e2e43c691751bc058e2b2db8eb02066c86505

  • SHA256

    9ac782c1c0a23ad6a1092bdaaa78c17561335625446f438d7d934b49aa523930

  • SHA512

    e486f6758391034ec3461efd6d3b1e35425dfa4facd0a5633cbc706899afc7926754d127b86135c3bf2887e1b45c8fbc6e90344958609ad9eb64d35c02fc5daa

  • SSDEEP

    3072:fftffhJCuEmUBCSjGoLpmSTLd4W1CV9uymmH2Ri/:HVfhgujiXxfdA9Pm

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      9ac782c1c0a23ad6a1092bdaaa78c17561335625446f438d7d934b49aa523930

    • Size

      132KB

    • MD5

      8bd5d568d369a2879c839bdab44f29b9

    • SHA1

      214e2e43c691751bc058e2b2db8eb02066c86505

    • SHA256

      9ac782c1c0a23ad6a1092bdaaa78c17561335625446f438d7d934b49aa523930

    • SHA512

      e486f6758391034ec3461efd6d3b1e35425dfa4facd0a5633cbc706899afc7926754d127b86135c3bf2887e1b45c8fbc6e90344958609ad9eb64d35c02fc5daa

    • SSDEEP

      3072:fftffhJCuEmUBCSjGoLpmSTLd4W1CV9uymmH2Ri/:HVfhgujiXxfdA9Pm

    Score
    10/10
    salitybackdoorevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks