Overview

overview

10

Static

static

10

d9731e7748...18.exe

windows7-x64

10

d9731e7748...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d9731e7748b49c037af6b91ad4a90509fac873a9857afdb63737eec8cec2d718

  • Size

    53KB

  • Sample

    241230-ecrdssxldp

  • MD5

    fdc5590af1f907d895b5dc5421c94ef2

  • SHA1

    9349702170553647bd55c1b0b6ff73139c8a782b

  • SHA256

    d9731e7748b49c037af6b91ad4a90509fac873a9857afdb63737eec8cec2d718

  • SHA512

    dee3ea0bb46803aad1ed5c19f36f0789d2eba6da0caff7afc1ea19b1d64ebc92f1a923151bdbf0188b8fd733a21283405f0667018458cab38386026a60bf291b

  • SSDEEP

    768:9W3cSlv6V/zeetSqiwkCAN6grUrlMlnJBIAQNuwQWtQl5nLlgG:8fu/ztSqiwkCAN6IlnrIhPtQJ3

Score
10/10
salitybackdoordiscoveryevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      d9731e7748b49c037af6b91ad4a90509fac873a9857afdb63737eec8cec2d718

    • Size

      53KB

    • MD5

      fdc5590af1f907d895b5dc5421c94ef2

    • SHA1

      9349702170553647bd55c1b0b6ff73139c8a782b

    • SHA256

      d9731e7748b49c037af6b91ad4a90509fac873a9857afdb63737eec8cec2d718

    • SHA512

      dee3ea0bb46803aad1ed5c19f36f0789d2eba6da0caff7afc1ea19b1d64ebc92f1a923151bdbf0188b8fd733a21283405f0667018458cab38386026a60bf291b

    • SSDEEP

      768:9W3cSlv6V/zeetSqiwkCAN6grUrlMlnJBIAQNuwQWtQl5nLlgG:8fu/ztSqiwkCAN6IlnrIhPtQJ3

    Score
    10/10
    salitybackdoorevasiontrojanupxdiscovery

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • Sality family

      sality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks