Overview

overview

10

Static

static

3

0111ecd879...c2.exe

windows7-x64

10

0111ecd879...c2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0111ecd87938ef5d2ae6485be1d80b5c83c067e44e2d05c2be9bd500846fe5c2

  • Size

    4.3MB

  • Sample

    240609-f7vv5sfa68

  • MD5

    f96743925cf734c324778c4f9712aa90

  • SHA1

    9a32a673b49de1ef14cc001450f1d038fea94567

  • SHA256

    0111ecd87938ef5d2ae6485be1d80b5c83c067e44e2d05c2be9bd500846fe5c2

  • SHA512

    e32c224e0dd6caaef7af90b4f2fb487c23ea361bc767331b31d4c682f2c81d4e16f00f5efb374c3e2d4f9942bce9153471ed27f5e2dc38cecdf89dd953df0712

  • SSDEEP

    98304:QfCjKYWpcq8wP4LPMHa3iWQDxUEL/e69L3HclEKpm67Nrplt1CFFrOG:mwK9cq8p3ixt3HclEKpmc9Cfj

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      0111ecd87938ef5d2ae6485be1d80b5c83c067e44e2d05c2be9bd500846fe5c2

    • Size

      4.3MB

    • MD5

      f96743925cf734c324778c4f9712aa90

    • SHA1

      9a32a673b49de1ef14cc001450f1d038fea94567

    • SHA256

      0111ecd87938ef5d2ae6485be1d80b5c83c067e44e2d05c2be9bd500846fe5c2

    • SHA512

      e32c224e0dd6caaef7af90b4f2fb487c23ea361bc767331b31d4c682f2c81d4e16f00f5efb374c3e2d4f9942bce9153471ed27f5e2dc38cecdf89dd953df0712

    • SSDEEP

      98304:QfCjKYWpcq8wP4LPMHa3iWQDxUEL/e69L3HclEKpm67Nrplt1CFFrOG:mwK9cq8p3ixt3HclEKpmc9Cfj

    Score
    10/10
    salitybackdoorevasiontrojanupx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Defense Evasion

Modify Registry

5
T1112

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

3
T1562

Disable or Modify Tools

3
T1562.001

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks