Overview

overview

10

Static

static

3

72452644ee...cs.dll

windows7-x64

10

72452644ee...cs.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    72452644ee36bfba9e27d92b40b7ace0_NeikiAnalytics.exe

  • Size

    120KB

  • Sample

    240531-xajv2sha7y

  • MD5

    72452644ee36bfba9e27d92b40b7ace0

  • SHA1

    7c7b0afeaf1ba8990701cdc858c720d9355b255d

  • SHA256

    94e35176a62a72c4c6e554adf3c4780566fe613273a8751c7fca089ffa03242f

  • SHA512

    238c6e4a790674b00c8a9edd770d405a99323444c9866bba0a2ca6578c894da49ca8a5283546f93c1255ea38a8ce3068e7777b2168f1110fe2f447c5faf3dde5

  • SSDEEP

    3072:bpy82/uCpQ+gfyeMLYyw7ds5MA+aYxYHLPoL:4/7pNIyBQ725MA+vxYrP

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      72452644ee36bfba9e27d92b40b7ace0_NeikiAnalytics.exe

    • Size

      120KB

    • MD5

      72452644ee36bfba9e27d92b40b7ace0

    • SHA1

      7c7b0afeaf1ba8990701cdc858c720d9355b255d

    • SHA256

      94e35176a62a72c4c6e554adf3c4780566fe613273a8751c7fca089ffa03242f

    • SHA512

      238c6e4a790674b00c8a9edd770d405a99323444c9866bba0a2ca6578c894da49ca8a5283546f93c1255ea38a8ce3068e7777b2168f1110fe2f447c5faf3dde5

    • SSDEEP

      3072:bpy82/uCpQ+gfyeMLYyw7ds5MA+aYxYHLPoL:4/7pNIyBQ725MA+vxYrP

    Score
    10/10
    salitybackdoorevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks