sality | 2829f736d1dc04765ffef688b40583b8a4d5174390b87ffac5a715cf5bdf0600

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26-12-2024 05:50

Target

2829f736d1dc04765ffef688b40583b8a4d5174390b87ffac5a715cf5bdf0600N.exe
Size

231KB
MD5

054b07fea5655429d14325fbbd037200
SHA1

3dc95a5095119740913fb4c40ae13858224c76ac
SHA256

2829f736d1dc04765ffef688b40583b8a4d5174390b87ffac5a715cf5bdf0600
SHA512

f455ea5757867a7eaf3260b4d2149fb78f126844c73338a2008ea9ed0f0befbb8ea8a996693d5b0c6892ae91b6a33e1c2525bbd3e49f9ada872ea3614c2ff477
SSDEEP

6144:7u4u6wmIo2EiO9rTBC+j8EP1P2CjkU7zGfNrGm:7u4u3mtzX9rTI+jz2Cj/7zk0m

Score

10^/10

sality backdoor upx

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

http://klkjwre77638dfqwieuoi888.info/

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2792-2-0x00000000007D0000-0x000000000185E000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\2829f736d1dc04765ffef688b40583b8a4d5174390b87ffac5a715cf5bdf0600N.exe
"C:\Users\Admin\AppData\Local\Temp\2829f736d1dc04765ffef688b40583b8a4d5174390b87ffac5a715cf5bdf0600N.exe"
1⤵
PID:2792

memory/2792-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-2-0x00000000007D0000-0x000000000185E000-memory.dmp

Filesize
16.6MB

Download
memory/2792-4-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download