Overview

overview

10

Static

static

3

3ba8db550c...cs.dll

windows7-x64

10

3ba8db550c...cs.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3ba8db550c52e2a5bb6af8b72723c940_NeikiAnalytics.exe

  • Size

    120KB

  • Sample

    240528-kmeqmsch4y

  • MD5

    3ba8db550c52e2a5bb6af8b72723c940

  • SHA1

    86f78e00a922b4020ffbca4c54cc72aba18ab833

  • SHA256

    d4dd43f8d585666709637c7fecfa7294d1fce970140720e5ead8f3184ef5a8e3

  • SHA512

    f85d6a4d54b53a9a1d5b2c0f1223b8fb42aab646383931b8c0ca6309fdfd2d4954aa2dcddbaec956ac6c58d6313ec183824f4334a2d175cc1674e2cb4deffae6

  • SSDEEP

    1536:mm9tXq4HR00xxyeliOVBgfn2udUdvW2J5VtdplKjvHKXp2rVh3C+isr7s:X9N00aelizn260+wcjHK52TC7Cs

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      3ba8db550c52e2a5bb6af8b72723c940_NeikiAnalytics.exe

    • Size

      120KB

    • MD5

      3ba8db550c52e2a5bb6af8b72723c940

    • SHA1

      86f78e00a922b4020ffbca4c54cc72aba18ab833

    • SHA256

      d4dd43f8d585666709637c7fecfa7294d1fce970140720e5ead8f3184ef5a8e3

    • SHA512

      f85d6a4d54b53a9a1d5b2c0f1223b8fb42aab646383931b8c0ca6309fdfd2d4954aa2dcddbaec956ac6c58d6313ec183824f4334a2d175cc1674e2cb4deffae6

    • SSDEEP

      1536:mm9tXq4HR00xxyeliOVBgfn2udUdvW2J5VtdplKjvHKXp2rVh3C+isr7s:X9N00aelizn260+wcjHK52TC7Cs

    Score
    10/10
    salitybackdoorevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks