Overview

overview

10

Static

static

3

bff021e0c6...18.exe

windows7-x64

10

bff021e0c6...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bff021e0c6d6313475efb1dfd0c850c9_JaffaCakes118

  • Size

    159KB

  • Sample

    241204-anfn8axmen

  • MD5

    bff021e0c6d6313475efb1dfd0c850c9

  • SHA1

    3810caf374fb66c7644be6863de9f4a889aa4e50

  • SHA256

    cda233d083b6576aafaccc86edc8b8a289d1dd7a7187ca3b6cb62e04a403574c

  • SHA512

    e0b5aa746a7becde489236fc8c9bf3bc4a1863205b3b97b9f59b6160ebbdce1b416dca619f49dfaebc08c48b84d912e64583a27d4a95bc0011619cfaab5c5c33

  • SSDEEP

    3072:j5dnu0W5ZyYi+KpM6TWPrtGGF4zl8bx3lLafra9shXtUmy7M8Y7JVY:DnxIZhKp1uFasx3lLaf2mhXtb7PY

Score
10/10
salitybackdoordiscoveryupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      bff021e0c6d6313475efb1dfd0c850c9_JaffaCakes118

    • Size

      159KB

    • MD5

      bff021e0c6d6313475efb1dfd0c850c9

    • SHA1

      3810caf374fb66c7644be6863de9f4a889aa4e50

    • SHA256

      cda233d083b6576aafaccc86edc8b8a289d1dd7a7187ca3b6cb62e04a403574c

    • SHA512

      e0b5aa746a7becde489236fc8c9bf3bc4a1863205b3b97b9f59b6160ebbdce1b416dca619f49dfaebc08c48b84d912e64583a27d4a95bc0011619cfaab5c5c33

    • SSDEEP

      3072:j5dnu0W5ZyYi+KpM6TWPrtGGF4zl8bx3lLafra9shXtUmy7M8Y7JVY:DnxIZhKp1uFasx3lLaf2mhXtb7PY

    Score
    10/10
    salitybackdoordiscoveryupx

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • Sality family

      sality

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks