Overview

overview

10

Static

static

3

0fcb0cff0c...ee.dll

windows7-x64

10

0fcb0cff0c...ee.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0fcb0cff0cf5a264112cea20f52cb1c0dab1682b0c1b7a6b33a38343a29c0eee

  • Size

    120KB

  • Sample

    240524-xf2m2sfe59

  • MD5

    9229b18bab1745835b35f699a0da4360

  • SHA1

    77efad7a7fad38414594f902aa5e0acd86989abe

  • SHA256

    0fcb0cff0cf5a264112cea20f52cb1c0dab1682b0c1b7a6b33a38343a29c0eee

  • SHA512

    6eda40fbd293e2fd3b409199966c8d963b6a015e72332d6748aba554ab497552dfef4f78ae81961a99154277938c0f63e5b303d5c6a2b256896a81b2df0d39a9

  • SSDEEP

    1536:aai8GysJzeRqyTSjFDibqoqr7T9zGJIRPRHjNeodTaGr3x7YCNeJ8MztHV:p5pRqy2DibHqL9zGQRE94aFKMzt1

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      0fcb0cff0cf5a264112cea20f52cb1c0dab1682b0c1b7a6b33a38343a29c0eee

    • Size

      120KB

    • MD5

      9229b18bab1745835b35f699a0da4360

    • SHA1

      77efad7a7fad38414594f902aa5e0acd86989abe

    • SHA256

      0fcb0cff0cf5a264112cea20f52cb1c0dab1682b0c1b7a6b33a38343a29c0eee

    • SHA512

      6eda40fbd293e2fd3b409199966c8d963b6a015e72332d6748aba554ab497552dfef4f78ae81961a99154277938c0f63e5b303d5c6a2b256896a81b2df0d39a9

    • SSDEEP

      1536:aai8GysJzeRqyTSjFDibqoqr7T9zGJIRPRHjNeodTaGr3x7YCNeJ8MztHV:p5pRqy2DibHqL9zGQRE94aFKMzt1

    Score
    10/10
    salitybackdoorevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks