Overview

overview

10

Static

static

3

f95bef472a...75.exe

windows7-x64

10

f95bef472a...75.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f95bef472a4a27173950a59fbadfe3caf2afcbd27d52afa9503e415a1fb62c75.exe

  • Size

    309KB

  • Sample

    241219-arydfaymax

  • MD5

    f52e000589991b8a11914d597abb6969

  • SHA1

    0a6434db4292e030fa0497b0e790a49760a99639

  • SHA256

    f95bef472a4a27173950a59fbadfe3caf2afcbd27d52afa9503e415a1fb62c75

  • SHA512

    f81f88e297d4d42b5059900b1712654bf7b300b9cb251edd69ec4e523b6c8c910ad28ca3a70698c6cff97536f1c6aa78d255b0a913695b312fa18050fb278f9a

  • SSDEEP

    6144:l/YWZdWgUY3wyzuRpw9IngBg4tNQp30m3s:l/YiWgNPJBgQNQp30t

Score
10/10
salitybackdoordiscoveryevasionspywarestealertrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      f95bef472a4a27173950a59fbadfe3caf2afcbd27d52afa9503e415a1fb62c75.exe

    • Size

      309KB

    • MD5

      f52e000589991b8a11914d597abb6969

    • SHA1

      0a6434db4292e030fa0497b0e790a49760a99639

    • SHA256

      f95bef472a4a27173950a59fbadfe3caf2afcbd27d52afa9503e415a1fb62c75

    • SHA512

      f81f88e297d4d42b5059900b1712654bf7b300b9cb251edd69ec4e523b6c8c910ad28ca3a70698c6cff97536f1c6aa78d255b0a913695b312fa18050fb278f9a

    • SSDEEP

      6144:l/YWZdWgUY3wyzuRpw9IngBg4tNQp30m3s:l/YiWgNPJBgQNQp30t

    Score
    10/10
    salitybackdoordiscoveryevasionspywarestealertrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • Sality family

      sality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

4
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

3
T1562.001

Modify Registry

6
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks