Overview

overview

10

Static

static

5

09cb123aa4...7N.exe

windows7-x64

10

09cb123aa4...7N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09cb123aa438b43d9cc6ce7392be23a993b205c2551c30006872541c854f00c7N.exe

  • Size

    929KB

  • Sample

    241216-h7ym5s1nhl

  • MD5

    ece926823ac507f14929a5eb83c00090

  • SHA1

    1cf5beace39ad4796522339f6375b5221d13682d

  • SHA256

    09cb123aa438b43d9cc6ce7392be23a993b205c2551c30006872541c854f00c7

  • SHA512

    0ecf6eae0551ea50af30b6c07171b671917bd27dbdbb55349193ce06bf8d12acc727dd79280ce9047565989f93bfa545ee81d65de3641e8df318cf4ae31fd2b5

  • SSDEEP

    12288:SR4qoezp6kG2Ruf32hYVtz1hu+CLsqPoyPs55obT3275oSRHGJucDw/h54RG:zy6JVf3BFU90Ws5OfUFHGJtohKRG

Score
10/10
salitybackdoordiscoveryevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      09cb123aa438b43d9cc6ce7392be23a993b205c2551c30006872541c854f00c7N.exe

    • Size

      929KB

    • MD5

      ece926823ac507f14929a5eb83c00090

    • SHA1

      1cf5beace39ad4796522339f6375b5221d13682d

    • SHA256

      09cb123aa438b43d9cc6ce7392be23a993b205c2551c30006872541c854f00c7

    • SHA512

      0ecf6eae0551ea50af30b6c07171b671917bd27dbdbb55349193ce06bf8d12acc727dd79280ce9047565989f93bfa545ee81d65de3641e8df318cf4ae31fd2b5

    • SSDEEP

      12288:SR4qoezp6kG2Ruf32hYVtz1hu+CLsqPoyPs55obT3275oSRHGJucDw/h54RG:zy6JVf3BFU90Ws5OfUFHGJtohKRG

    Score
    10/10
    salitybackdoordiscoveryevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • Sality family

      sality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks