Overview

overview

10

Static

static

3

logs/modif...xm.exe

windows7-x64

10

logs/modif...xm.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_0a4a0bd4dfa4de8b5660b665cbc363ed

  • Size

    69KB

  • Sample

    241231-h2svpstnes

  • MD5

    0a4a0bd4dfa4de8b5660b665cbc363ed

  • SHA1

    386b3f57da5fd28afac2dc2b432572fd02ebc37a

  • SHA256

    94628faa8a5c7fd1da375dff7495a38d063eee0342557fb963e99a26ed900e5f

  • SHA512

    609c35d257ba8b118fbbaa39c3656cec27c1c3ea6640474caf3184ae62cede7fbe72c5781d82bad2c01f8b6d3f6ff7e942eb0480b4d82f6cae43b47b9977ad53

  • SSDEEP

    1536:LDd/id3T08/8/xJGQJ0Jva0RiZItQ+JWSDg7phvfV:9a37BQJ09Z46tX1DgFhvd

Score
10/10
salitybackdoordiscoveryevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

http://klkjwre77638dfqwieuoi888.info/

Targets

    • Target

      logs/modified_files/C/syspuxm.exe/syspuxm.exe

    • Size

      70KB

    • MD5

      bc9fe9457030d81eb55322c89d65c3ff

    • SHA1

      ab570c602fcd6149976f52ebc35e69324ea9512c

    • SHA256

      b962405951204905dfd57cab9723d647ea9c5466aefcd5c5a2bac4ddf83a4318

    • SHA512

      968b173207599b005ae6bd1e2846e2e66d3f30e5a45b583586f0530e10918f2b5828de554151328050b261084e4f8ddc7a1ab4ecb94463b42fb33bbbd679ae70

    • SSDEEP

      1536:TEmcAe0ey668/xJGQJ0Bva0Ri1ItQ+JWSDg8phvf/:TSA2y6OQJ0VZ4mtX1Dg4hvH

    Score
    10/10
    salitybackdoordiscoveryevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • Sality family

      sality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks