sality | 4f5c33b54a841bae7acb0e8216de5120a5b068ac60cfd158eca260d1f83cf067

Analysis

max time kernel
132s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 08:45

Target

1408_cn_V8.3.0.0/1408_cn_8.3.0.0/DVR/DVR.exe
Size

96KB
MD5

924329ec1dbf39d38db800125f32808e
SHA1

421593985a6602cd73ab263d5669c168b8d37e1a
SHA256

d4fb3aa593cc8c493aaa8ca767b8d8556e68ddfd15a3616422435d1c4ad735aa
SHA512

bae62d29461215d985cd1852768994679512a8a8a0cb4dc69708efb6be979393512042c880b9fc6e6debfc34e1452a3b9d75cc3faff4642c07f4a48f7366bf1c
SSDEEP

1536:CJsR4bLpoma63rPHhoC9JZPtqljS2ky4dWExgYJtp343gABiaO:Rioma67PHrojp4cEx5zNAXVO

Score

10^/10

sality backdoor upx

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral6/memory/512-1-0x00000000007C0000-0x00000000017F3000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\DVR\DVR.exe
"C:\Users\Admin\AppData\Local\Temp\1408_cn_V8.3.0.0\1408_cn_8.3.0.0\DVR\DVR.exe"
1⤵
PID:512

memory/512-2-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/512-0-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/512-1-0x00000000007C0000-0x00000000017F3000-memory.dmp

Filesize
16.2MB

Download
memory/512-3-0x00000000007C0000-0x00000000017F3000-memory.dmp

Filesize
16.2MB

Download