General

  • Target

    14a79dec201c60ea5a7f3458151c1e839daf5223391c1eed5803269e7e8c8665N.exe

  • Size

    750KB

  • Sample

    241216-k61r8atnew

  • MD5

    8f345fa3b90b0bb28250725141466e30

  • SHA1

    7ed1057356702015a6916eb5c7f4c4bafae17edf

  • SHA256

    14a79dec201c60ea5a7f3458151c1e839daf5223391c1eed5803269e7e8c8665

  • SHA512

    796a34b9a52ec13218fcdc1f0e701d63d488ab448db5832bf52dbbaa63e1686bf9662ce3b8affad85df87b1a1b90a6dc9d15207b6178d63665d4fae90657dc96

  • SSDEEP

    12288:2oZ5cyP2UluWW7hvraWDE/7bQGLnkQzeD6lHCMfm7HUb3s9a454q5:2oHhP2YW7hzaN7bQ8HCM+4QI45H

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      14a79dec201c60ea5a7f3458151c1e839daf5223391c1eed5803269e7e8c8665N.exe

    • Size

      750KB

    • MD5

      8f345fa3b90b0bb28250725141466e30

    • SHA1

      7ed1057356702015a6916eb5c7f4c4bafae17edf

    • SHA256

      14a79dec201c60ea5a7f3458151c1e839daf5223391c1eed5803269e7e8c8665

    • SHA512

      796a34b9a52ec13218fcdc1f0e701d63d488ab448db5832bf52dbbaa63e1686bf9662ce3b8affad85df87b1a1b90a6dc9d15207b6178d63665d4fae90657dc96

    • SSDEEP

      12288:2oZ5cyP2UluWW7hvraWDE/7bQGLnkQzeD6lHCMfm7HUb3s9a454q5:2oHhP2YW7hzaN7bQ8HCM+4QI45H

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • Sality family

    • Windows security bypass

    • Windows security modification

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks