sality | dbfa2a2c64f3ada4405fe4316e8cd6325dd3e84189e6c3bc4a458a0c75040af3

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 03:32

Target

dbfa2a2c64f3ada4405fe4316e8cd6325dd3e84189e6c3bc4a458a0c75040af3.exe
Size

968KB
MD5

310df0dbf5db85dd66671bd787da7308
SHA1

dde285802d343f89c0dc862eb9cd3cfa6b474460
SHA256

dbfa2a2c64f3ada4405fe4316e8cd6325dd3e84189e6c3bc4a458a0c75040af3
SHA512

39ff135fbf2b73c0add3f9a94dd3cd4cdce9707749a2b2695312ab7102bfdc13ecd525e1eae6178d6e373a144ba0d7372808ad2e44b46699f44cdffe949448de
SSDEEP

3072:8AK+74WNZZv17Bc9hD+9oS0wnNsEtLOahIObR0vYfoDcTpLU5/QKe24Vd9oEtTHc:8WNZK/wnNs4h/lYcTpe6bT9i

Score

10^/10

sality backdoor upx

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2772-1-0x0000000001E90000-0x0000000002F4A000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\dbfa2a2c64f3ada4405fe4316e8cd6325dd3e84189e6c3bc4a458a0c75040af3.exe
"C:\Users\Admin\AppData\Local\Temp\dbfa2a2c64f3ada4405fe4316e8cd6325dd3e84189e6c3bc4a458a0c75040af3.exe"
1⤵
PID:2772

memory/2772-1-0x0000000001E90000-0x0000000002F4A000-memory.dmp

Filesize
16.7MB

Download
memory/2772-2-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2772-0-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download