Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-12-2024 07:20
General
-
Target
ab2f046d42ddb2e36c4921e26e22fdf174dee7428252c10f0b22ae73e1e0c8dd.exe
-
Size
3.5MB
-
MD5
54d36d4246bfb82d46da948ad48923d3
-
SHA1
8dd2d385047089bda74b8142e8fd6e5bd2aff577
-
SHA256
ab2f046d42ddb2e36c4921e26e22fdf174dee7428252c10f0b22ae73e1e0c8dd
-
SHA512
a75ee0e8d3c6df389d942ffe12da6ba63a1fad6cf7b318cd52dcf2a747a6e1c081b1d3ec294b0040001830ba5f1061fd95cde0ec4cece68c5291c5ade056c6af
-
SSDEEP
98304:2TQIDg+XbUhJ64ReUMjKO3/VhEqwjWZoYbmyx:2T7bUpeUMeBjWVH
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab2f046d42ddb2e36c4921e26e22fdf174dee7428252c10f0b22ae73e1e0c8dd.exe"C:\Users\Admin\AppData\Local\Temp\ab2f046d42ddb2e36c4921e26e22fdf174dee7428252c10f0b22ae73e1e0c8dd.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
16.7MB
-
Filesize
16.7MB