sality | d94e05364b8846dbf964d3b9dc0bee1b45763c0054b28ba52359cb6f18fee3d3 | Triage

Submit
Reports

Overview

overview

Static

static

b2f61cb222...18.exe

windows7-x64

b2f61cb222...18.exe

windows10-2004-x64

Sharing

General

Target

b2f61cb22242c461c507b489cb05e10f_JaffaCakes118
Size

117KB
Sample

241129-wqarmszjfs
MD5

b2f61cb22242c461c507b489cb05e10f
SHA1

9f6f44a42f200ee5f0d10f8b5055c022ab11bfd1
SHA256

d94e05364b8846dbf964d3b9dc0bee1b45763c0054b28ba52359cb6f18fee3d3
SHA512

3652e6cc3340ede152029cbeff0fc494f7339462e2ec502052aa3937c535b9cda634345bca0c2ff44078557fbc8964dbfe77e06ca3c9bdd981bfc92d9d533394
SSDEEP

3072:BNW7dEvotvXhMbnSxcORQ52VnTfOvwLISWKGpKGW6:BNW7mvIxUu5RQ5e6JSWKaM6

Score

10^/10

sality xtremerat backdoor discovery evasion persistence rat spyware trojan upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

b2f61cb22242c461c507b489cb05e10f_JaffaCakes118.exe

Resource

win7-20240903-en

sality xtremerat backdoor discovery evasion persistence rat spyware trojan upx

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

b2f61cb22242c461c507b489cb05e10f_JaffaCakes118.exe

Resource

win10v2004-20241007-en

sality xtremerat backdoor discovery evasion persistence rat spyware trojan upx

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Extracted

Family

xtremerat

C2

mano7848.no-ip.info

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  b2f61cb22242c461c507b489cb05e10f_JaffaCakes118
- Size
  
  117KB
- MD5
  
  b2f61cb22242c461c507b489cb05e10f
- SHA1
  
  9f6f44a42f200ee5f0d10f8b5055c022ab11bfd1
- SHA256
  
  d94e05364b8846dbf964d3b9dc0bee1b45763c0054b28ba52359cb6f18fee3d3
- SHA512
  
  3652e6cc3340ede152029cbeff0fc494f7339462e2ec502052aa3937c535b9cda634345bca0c2ff44078557fbc8964dbfe77e06ca3c9bdd981bfc92d9d533394
- SSDEEP
  
  3072:BNW7dEvotvXhMbnSxcORQ52VnTfOvwLISWKGpKGW6:BNW7mvIxUu5RQ5e6JSWKaM6
Score

10^/10

sality xtremerat backdoor discovery evasion persistence rat spyware trojan upx
- Detect XtremeRAT payload
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Xtremerat family
  xtremerat
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salityxtremeratbackdoordiscoveryevasionpersistenceratspywaretrojanupx

behavioral2

salityxtremeratbackdoordiscoveryevasionpersistenceratspywaretrojanupx

© 2018-2025

Terms | Privacy