Overview

overview

10

Static

static

3

e6f623cace...0N.exe

windows7-x64

10

e6f623cace...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e6f623cace18c65a3503af1608b4fb3da5ed5e004b90e731d2da55414f02e5e0N

  • Size

    101KB

  • Sample

    241006-g8resayekb

  • MD5

    016a308f0291dfeff8d2c34615a1c770

  • SHA1

    f17caa8186bd2e96b70b5c45f1d50a341b2f12ce

  • SHA256

    e6f623cace18c65a3503af1608b4fb3da5ed5e004b90e731d2da55414f02e5e0

  • SHA512

    b215af3e952fc9ae5af13488659c4d4e2ca1e1d7b40ebf27d6d82a3aee54982b55e0f8ca6a36b45a4cdb064d3751d50ab8a52bb944ad5ef3f038721b04593469

  • SSDEEP

    3072:yk0JJXOeQOMkTazkUCoPYVJOprlJMJfO:yb/Oe/TI54JfO

Score
10/10
salitybackdoordiscoveryevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

http://klkjwre77638dfqwieuoi888.info/

Targets

    • Target

      e6f623cace18c65a3503af1608b4fb3da5ed5e004b90e731d2da55414f02e5e0N

    • Size

      101KB

    • MD5

      016a308f0291dfeff8d2c34615a1c770

    • SHA1

      f17caa8186bd2e96b70b5c45f1d50a341b2f12ce

    • SHA256

      e6f623cace18c65a3503af1608b4fb3da5ed5e004b90e731d2da55414f02e5e0

    • SHA512

      b215af3e952fc9ae5af13488659c4d4e2ca1e1d7b40ebf27d6d82a3aee54982b55e0f8ca6a36b45a4cdb064d3751d50ab8a52bb944ad5ef3f038721b04593469

    • SSDEEP

      3072:yk0JJXOeQOMkTazkUCoPYVJOprlJMJfO:yb/Oe/TI54JfO

    Score
    10/10
    salitybackdoordiscoveryevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks