Overview

overview

10

Static

static

3

cde5baf049...18.exe

windows7-x64

3

cde5baf049...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cde5baf04917e8df1a346cdc82c06ffa_JaffaCakes118

  • Size

    150KB

  • Sample

    241206-tlg9ta1paq

  • MD5

    cde5baf04917e8df1a346cdc82c06ffa

  • SHA1

    c1bf131163f13072b70675f3c697787df0010287

  • SHA256

    d5cacf7eb2e09d0cae9b336287f9ef0d989eec54529941c7547f75d8233ca50f

  • SHA512

    5c340b5f359f3bd522b6b361bcdb32b18dd03f325bd180754b93afa154aec4f1c6a7d44e3da17e9d5d549a932160257302d602486e7064ebdfda4876ea6d3bf6

  • SSDEEP

    3072:KWl1tXusjkJnkVocBfXEfW+AFLfrCM18BUIAJSGcCJ6e/j:KWlzqcBfXE++Axl1uARPJLj

Score
10/10
salitybackdoordiscoveryevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      cde5baf04917e8df1a346cdc82c06ffa_JaffaCakes118

    • Size

      150KB

    • MD5

      cde5baf04917e8df1a346cdc82c06ffa

    • SHA1

      c1bf131163f13072b70675f3c697787df0010287

    • SHA256

      d5cacf7eb2e09d0cae9b336287f9ef0d989eec54529941c7547f75d8233ca50f

    • SHA512

      5c340b5f359f3bd522b6b361bcdb32b18dd03f325bd180754b93afa154aec4f1c6a7d44e3da17e9d5d549a932160257302d602486e7064ebdfda4876ea6d3bf6

    • SSDEEP

      3072:KWl1tXusjkJnkVocBfXEfW+AFLfrCM18BUIAJSGcCJ6e/j:KWlzqcBfXE++Axl1uARPJLj

    Score
    10/10
    discoverysalitybackdoorevasiontrojanupx

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • Sality family

      sality

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks