Overview

overview

10

Static

static

3

f0943c50f3...18.exe

windows7-x64

10

f0943c50f3...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f0943c50f32a3d76c74e4b0846de571a_JaffaCakes118

  • Size

    216KB

  • Sample

    240921-zjenssshkk

  • MD5

    f0943c50f32a3d76c74e4b0846de571a

  • SHA1

    e707f85fbc2ce1c26e88218e636c1ec7276ffbe5

  • SHA256

    1117be9fe9d9c61c3878cde45a14ec688811a6537ee64de6420dedd80c9baa18

  • SHA512

    34a7d252a4ebc17bcc63ec597d07b01f304765c87c40b85cf4d5c7177f1364976fb6eb497a0860e5781d7db0c400f96995546eeb38bbec48eb2396061b5b2f47

  • SSDEEP

    3072:lYgJesziglPZ1yxyvZcMO/6T4nIB5B3e9uGxpCQvSYRR0xKQaCb8gi8hW:D5zplxAAZcR/6TkINTalRGnaCbXi8h

Score
10/10
salitybackdoordiscoveryevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

http://klkjwre77638dfqwieuoi888.info/

Targets

    • Target

      f0943c50f32a3d76c74e4b0846de571a_JaffaCakes118

    • Size

      216KB

    • MD5

      f0943c50f32a3d76c74e4b0846de571a

    • SHA1

      e707f85fbc2ce1c26e88218e636c1ec7276ffbe5

    • SHA256

      1117be9fe9d9c61c3878cde45a14ec688811a6537ee64de6420dedd80c9baa18

    • SHA512

      34a7d252a4ebc17bcc63ec597d07b01f304765c87c40b85cf4d5c7177f1364976fb6eb497a0860e5781d7db0c400f96995546eeb38bbec48eb2396061b5b2f47

    • SSDEEP

      3072:lYgJesziglPZ1yxyvZcMO/6T4nIB5B3e9uGxpCQvSYRR0xKQaCb8gi8hW:D5zplxAAZcR/6TkINTalRGnaCbXi8h

    Score
    10/10
    salitybackdoordiscoveryevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks