Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
04-07-2024 17:22
General
-
Target
[DemonArchives]3825817f6028f26ff0b5cd748559286d.exe
-
Size
2.5MB
-
MD5
3825817f6028f26ff0b5cd748559286d
-
SHA1
b6daaaac0bd28b11a8ff38aa446b131a0e2ec15b
-
SHA256
570c04532b048842ba34ea751b9e584464103b77cf9fe3b9c4306477629e464a
-
SHA512
1cc30a7e5add9ef0ac54ff6fc0847b79fcbc6e8b7e94540e10c4167ba05cf08b9e99f7c79794a9c6b803c8d8ce54246c60f976b103d94a105c0594c97eb200d7
-
SSDEEP
49152:brhD5QMFJoa/PMG171WCwYU1tHbevvZ2P/huOiQ4LjwOb3dJSd8vr06:b55QTEPMGp0/huOiRLjwOb3dBb
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\[DemonArchives]3825817f6028f26ff0b5cd748559286d.exe"C:\Users\Admin\AppData\Local\Temp\[DemonArchives]3825817f6028f26ff0b5cd748559286d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD53825817f6028f26ff0b5cd748559286d
SHA1b6daaaac0bd28b11a8ff38aa446b131a0e2ec15b
SHA256570c04532b048842ba34ea751b9e584464103b77cf9fe3b9c4306477629e464a
SHA5121cc30a7e5add9ef0ac54ff6fc0847b79fcbc6e8b7e94540e10c4167ba05cf08b9e99f7c79794a9c6b803c8d8ce54246c60f976b103d94a105c0594c97eb200d7
-
Filesize
16.7MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
16.7MB