sality | 72450e6d334376bf84398dd08086a305615a7bcdeaab08689434ad7cd1b0bfbc

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 16:53

Target

72450e6d334376bf84398dd08086a305615a7bcdeaab08689434ad7cd1b0bfbc.exe
Size

160KB
MD5

c71aa675b069d3916ae42c32fda01f33
SHA1

909c83d48fc0d50e17b1c172aa6c2c13e6f448ff
SHA256

72450e6d334376bf84398dd08086a305615a7bcdeaab08689434ad7cd1b0bfbc
SHA512

ae9e00b35cd1a9ceb26048cee6303aebe591d8b0b00119d4362ac3031ad82254bfa8b2cfcd7a598c4cec0ece55a7e89fa5fdaa67974baf4c64ffbf8da93e99bf
SSDEEP

3072:uzLN8EyK94XaxdhwxBShreuZT6PvBjYUAgqEk:gLuFTBShUpjY2o

Score

10^/10

sality backdoor upx

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2204-3-0x0000000001D90000-0x0000000002E1E000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\72450e6d334376bf84398dd08086a305615a7bcdeaab08689434ad7cd1b0bfbc.exe
"C:\Users\Admin\AppData\Local\Temp\72450e6d334376bf84398dd08086a305615a7bcdeaab08689434ad7cd1b0bfbc.exe"
1⤵
PID:2204

memory/2204-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2204-3-0x0000000001D90000-0x0000000002E1E000-memory.dmp

Filesize
16.6MB

Download
memory/2204-2-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download