Overview

overview

10

Static

static

3

4c7adf51d7...cs.exe

windows7-x64

10

4c7adf51d7...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4c7adf51d74764fc83d628e9a8cc9c60_NeikiAnalytics.exe

  • Size

    1.5MB

  • Sample

    240525-temwqaac47

  • MD5

    4c7adf51d74764fc83d628e9a8cc9c60

  • SHA1

    1a304eab976069218440a5aa9d4ec3a3d89638d8

  • SHA256

    b24d01edb8b76471a6c715b3a8c76d91a20465cea1c5f3a07d3d47f0ea6ccd90

  • SHA512

    b1a41d266c6b685de4b1bd62ff3048c30e9032a65942f4444c9873ba84dc273c447f27a4a5685d29ba345d5346a7fa95e4cad254f7c5ef904f5f4306a0923009

  • SSDEEP

    24576:XuhYGACNtzlz116k7GXySXNY/zOQb/WV6VDyXi4M7bxKfeJpfSSj1:XuhplNtzlz1MyS7XNySmOVcDyM5tDN1

Score
10/10
salitybackdoorbootkitevasionpersistencetrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      4c7adf51d74764fc83d628e9a8cc9c60_NeikiAnalytics.exe

    • Size

      1.5MB

    • MD5

      4c7adf51d74764fc83d628e9a8cc9c60

    • SHA1

      1a304eab976069218440a5aa9d4ec3a3d89638d8

    • SHA256

      b24d01edb8b76471a6c715b3a8c76d91a20465cea1c5f3a07d3d47f0ea6ccd90

    • SHA512

      b1a41d266c6b685de4b1bd62ff3048c30e9032a65942f4444c9873ba84dc273c447f27a4a5685d29ba345d5346a7fa95e4cad254f7c5ef904f5f4306a0923009

    • SSDEEP

      24576:XuhYGACNtzlz116k7GXySXNY/zOQb/WV6VDyXi4M7bxKfeJpfSSj1:XuhplNtzlz1MyS7XNySmOVcDyM5tDN1

    Score
    10/10
    salitybackdoorbootkitevasionpersistencetrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks