General
- Target 9f687e52ac47b3d6a51d43b833348400_NeikiAnalytics.exe
- Size 159KB
- Sample240614-d8zvdatfnc
- SHA256 436846c3db0247c2dc898bbdff318cde6d206733d9e3004f9c1abadba1afb3c3
Score
10/10
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Targets
-
- Target 9f687e52ac47b3d6a51d43b833348400_NeikiAnalytics.exe
- Size 159KB
- SHA256 436846c3db0247c2dc898bbdff318cde6d206733d9e3004f9c1abadba1afb3c3
Score10/10-
Modifies firewall policy service
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass
-
Windows security bypass
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1