Overview

overview

10

Static

static

3

305473f1e3...cs.exe

windows7-x64

10

305473f1e3...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    305473f1e3cce2a2b4cb9af45e592f60_NeikiAnalytics.exe

  • Size

    104KB

  • Sample

    240519-aj4v9afh6y

  • MD5

    305473f1e3cce2a2b4cb9af45e592f60

  • SHA1

    ada3b05e075cf869cf3cc2ba79e25df3a6e4ab3c

  • SHA256

    d7f70dbbb4fc2083a45d010e8487cf722057c47be067f00b3c0e275e34e3706d

  • SHA512

    cd839e14f0fc2bc510e2684d70504e4058bc2269ffe325a016dfed3dc2d82109986c44b30b17474b3dadb1fb947d2b2a245b85c71b40759c0fa6f369015f0eba

  • SSDEEP

    1536:SNJXdTLV+DNE20lBmpuzNinQ465a9VNGBKOUg4AZoB2XEojBcHVlfRxwe2XT:EJXdTLgDK3LmpaKm5a9Glp4AjXm1lyD

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      305473f1e3cce2a2b4cb9af45e592f60_NeikiAnalytics.exe

    • Size

      104KB

    • MD5

      305473f1e3cce2a2b4cb9af45e592f60

    • SHA1

      ada3b05e075cf869cf3cc2ba79e25df3a6e4ab3c

    • SHA256

      d7f70dbbb4fc2083a45d010e8487cf722057c47be067f00b3c0e275e34e3706d

    • SHA512

      cd839e14f0fc2bc510e2684d70504e4058bc2269ffe325a016dfed3dc2d82109986c44b30b17474b3dadb1fb947d2b2a245b85c71b40759c0fa6f369015f0eba

    • SSDEEP

      1536:SNJXdTLV+DNE20lBmpuzNinQ465a9VNGBKOUg4AZoB2XEojBcHVlfRxwe2XT:EJXdTLgDK3LmpaKm5a9Glp4AjXm1lyD

    Score
    10/10
    salitybackdoorevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Defense Evasion

Modify Registry

5
T1112

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

3
T1562

Disable or Modify Tools

3
T1562.001

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks