Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05/12/2024, 10:39
General
-
Target
4e588fc1c336e8c453c3a29b30eccf76fd2122f299b643c4197d67f2896dc17c.exe
-
Size
120KB
-
MD5
dc3bbfc6e9091a53a317227febc1e4d7
-
SHA1
080aac5ec1de2bdfb46be09d665d11ef188ad540
-
SHA256
4e588fc1c336e8c453c3a29b30eccf76fd2122f299b643c4197d67f2896dc17c
-
SHA512
36e0cbe1744bbbebfdceb73c1ccc17729de4652abf9ff18b75664f2462eabe96b4377059d7e366a396d679512d803c5b44d5f5fceb6ff03b4d72481e15f97ecd
-
SSDEEP
3072:m9tSR5/g/J/h5uVm9Zi68W/4vphU83q64EX26jMt7Egylk:mWR5/g/J/vzr8WQ/U83JH2UMEgJ
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e588fc1c336e8c453c3a29b30eccf76fd2122f299b643c4197d67f2896dc17c.exe"C:\Users\Admin\AppData\Local\Temp\4e588fc1c336e8c453c3a29b30eccf76fd2122f299b643c4197d67f2896dc17c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
-
Filesize
16.7MB
-
Filesize
124KB
-
Filesize
16.7MB