Overview

overview

10

Static

static

3

5270bcd5b8...18.exe

windows7-x64

3

5270bcd5b8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5270bcd5b8f6380a2e3c202b8cad4428_JaffaCakes118

  • Size

    306KB

  • Sample

    241017-sdkjjavgml

  • MD5

    5270bcd5b8f6380a2e3c202b8cad4428

  • SHA1

    40c72bc46bbccd80fb85ec9f8c79717f0cd1d7e2

  • SHA256

    ef4d03ce5d73fb23f11db89b9f24efaff5383e52a82eb85d9093f5962e30a69b

  • SHA512

    50fb77263530fe8de66a674f2eafa48ab0eca41493c53c72d9c391c6294bce14464f6b2ed1915f04b6ef810e248e51f827e4c5e640be494aad641dd971c75617

  • SSDEEP

    6144:/UmvWIA11WZ4un3ZH5iMaJnawmvc18Iy+5UAWeavzVlWAJwMlLrPxCx9ZXqm/PR4:bvWP11WZpGMaJnhmkiIjuAWHvzyMwMV/

Score
10/10
salitybackdoordiscoveryevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      5270bcd5b8f6380a2e3c202b8cad4428_JaffaCakes118

    • Size

      306KB

    • MD5

      5270bcd5b8f6380a2e3c202b8cad4428

    • SHA1

      40c72bc46bbccd80fb85ec9f8c79717f0cd1d7e2

    • SHA256

      ef4d03ce5d73fb23f11db89b9f24efaff5383e52a82eb85d9093f5962e30a69b

    • SHA512

      50fb77263530fe8de66a674f2eafa48ab0eca41493c53c72d9c391c6294bce14464f6b2ed1915f04b6ef810e248e51f827e4c5e640be494aad641dd971c75617

    • SSDEEP

      6144:/UmvWIA11WZ4un3ZH5iMaJnawmvc18Iy+5UAWeavzVlWAJwMlLrPxCx9ZXqm/PR4:bvWP11WZpGMaJnhmkiIjuAWHvzyMwMV/

    Score
    10/10
    discoverysalitybackdoorevasiontrojanupx

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks