General
- Target ebc3a274210b8d24a55d6fe265c20c0130e1567199dc678f982eab507a37c66e
- Size 3.3MB
- Sample240612-3vdgnazbll
- SHA256 ebc3a274210b8d24a55d6fe265c20c0130e1567199dc678f982eab507a37c66e
Score
10/10
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Targets
-
- Target ebc3a274210b8d24a55d6fe265c20c0130e1567199dc678f982eab507a37c66e
- Size 3.3MB
- SHA256 ebc3a274210b8d24a55d6fe265c20c0130e1567199dc678f982eab507a37c66e
Score10/10Modifies firewall policy service
Sality
Sality is backdoor written in C++, first discovered in 2003.
UAC bypass
Windows security bypass
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Windows security modification
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1