Overview

overview

10

Static

static

3

d8e943d029...18.exe

windows7-x64

10

d8e943d029...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d8e943d02942e5f09904436bc8617cea_JaffaCakes118

  • Size

    128KB

  • Sample

    241209-k93e8asrfw

  • MD5

    d8e943d02942e5f09904436bc8617cea

  • SHA1

    80fa1807ee097816f47d1f5698615aa511eab3bd

  • SHA256

    a8e9e807a258faf20c5adb1a5dc0171c3d903c1c4ca8cc84498b6ee9d5bf9961

  • SHA512

    8f07d18d02ac17365cfe8c2cd435227aa8124e493771e80f0e4372a2917b7c30ad24d4a8a1c73f9e757a320b5db5478ed73915dc1ca791243162f4d0e306b215

  • SSDEEP

    3072:DxhTKNys+dRP67vHVO4tcPEZ4X84Tnref:9lKQZdRi71ltcPE+TnKf

Score
10/10
salitybackdoordiscoveryevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      d8e943d02942e5f09904436bc8617cea_JaffaCakes118

    • Size

      128KB

    • MD5

      d8e943d02942e5f09904436bc8617cea

    • SHA1

      80fa1807ee097816f47d1f5698615aa511eab3bd

    • SHA256

      a8e9e807a258faf20c5adb1a5dc0171c3d903c1c4ca8cc84498b6ee9d5bf9961

    • SHA512

      8f07d18d02ac17365cfe8c2cd435227aa8124e493771e80f0e4372a2917b7c30ad24d4a8a1c73f9e757a320b5db5478ed73915dc1ca791243162f4d0e306b215

    • SSDEEP

      3072:DxhTKNys+dRP67vHVO4tcPEZ4X84Tnref:9lKQZdRi71ltcPE+TnKf

    Score
    10/10
    salitybackdoordiscoveryevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • Sality family

      sality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks