Overview

overview

10

Static

static

3

62cfddd030...3N.exe

windows7-x64

10

62cfddd030...3N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    62cfddd03023a777626b82cd7143dae6f4af055f71f9572704d3d120980252d3N.exe

  • Size

    3.1MB

  • Sample

    241120-d6hs3szcpb

  • MD5

    119652b5703875dce6ca31e13c5c7580

  • SHA1

    2e3b50184e5905b606b6e0ada46777889d55dba9

  • SHA256

    62cfddd03023a777626b82cd7143dae6f4af055f71f9572704d3d120980252d3

  • SHA512

    5273df782d91ab104b47825f8801238fd8a27cdcbbd39ac8c784762e33b29353611bb6ca279bbcb47705f369984ad92d116e83ebf7728e3e73d77368ec8fe3a2

  • SSDEEP

    49152:qo7VF4WL9bZ9VfvauSAtmjnvVEEDRr3X85oJn/IM7s0Ic6:qo7NLBZ7faB3X85o5/M08

Score
10/10
salitybackdoordiscoveryevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      62cfddd03023a777626b82cd7143dae6f4af055f71f9572704d3d120980252d3N.exe

    • Size

      3.1MB

    • MD5

      119652b5703875dce6ca31e13c5c7580

    • SHA1

      2e3b50184e5905b606b6e0ada46777889d55dba9

    • SHA256

      62cfddd03023a777626b82cd7143dae6f4af055f71f9572704d3d120980252d3

    • SHA512

      5273df782d91ab104b47825f8801238fd8a27cdcbbd39ac8c784762e33b29353611bb6ca279bbcb47705f369984ad92d116e83ebf7728e3e73d77368ec8fe3a2

    • SSDEEP

      49152:qo7VF4WL9bZ9VfvauSAtmjnvVEEDRr3X85oJn/IM7s0Ic6:qo7NLBZ7faB3X85o5/M08

    Score
    10/10
    salitybackdoordiscoveryevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • Sality family

      sality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks