Overview

overview

10

Static

static

3

18519e3c86...18.exe

windows7-x64

3

18519e3c86...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18519e3c86716b25d52bb318a8dbfc0d_JaffaCakes118

  • Size

    276KB

  • Sample

    241006-qzwgta1dqe

  • MD5

    18519e3c86716b25d52bb318a8dbfc0d

  • SHA1

    a82aca85c8fc6a411a6c3793268bc8dc5df40a36

  • SHA256

    c8aaa135693694ae8fae11db2a89cf4acca16e74e3107fe4bb3b7942e58c5788

  • SHA512

    79ea665b60aaa8754e5ef07ed0d7861c150ee8569132b2e612670244db52972c6b685d708665cbbe45d9ea7a46469721e26e0a4c9941877aee645ba58bd3fbd0

  • SSDEEP

    6144:cIm23rccZiglk0w1upkA+YMA40LS2PCSQj:cOr7ZigT+Y1Q2PJo

Score
10/10
salitybackdoordiscoveryevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      18519e3c86716b25d52bb318a8dbfc0d_JaffaCakes118

    • Size

      276KB

    • MD5

      18519e3c86716b25d52bb318a8dbfc0d

    • SHA1

      a82aca85c8fc6a411a6c3793268bc8dc5df40a36

    • SHA256

      c8aaa135693694ae8fae11db2a89cf4acca16e74e3107fe4bb3b7942e58c5788

    • SHA512

      79ea665b60aaa8754e5ef07ed0d7861c150ee8569132b2e612670244db52972c6b685d708665cbbe45d9ea7a46469721e26e0a4c9941877aee645ba58bd3fbd0

    • SSDEEP

      6144:cIm23rccZiglk0w1upkA+YMA40LS2PCSQj:cOr7ZigT+Y1Q2PJo

    Score
    10/10
    discoverysalitybackdoorevasiontrojanupx

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks