Overview

overview

10

Static

static

3

d395fba53f...bN.exe

windows7-x64

10

d395fba53f...bN.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    31-12-2024 11:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d395fba53f8dad6a1e76add8cb7c98aad1ba99ba88658f872441e24f5845d7bbN.exe

  • Size

    197KB

  • MD5

    23a7da9dd8920afeca46931c6636c3e0

  • SHA1

    e741fdb0ff09d5a10391fb5863f555a9b7a10d79

  • SHA256

    d395fba53f8dad6a1e76add8cb7c98aad1ba99ba88658f872441e24f5845d7bb

  • SHA512

    402d6f0834777adf56a2556fdabf22c5b0d3077c0fe899c7e42219031f1b78ea1b0d77e0d7e3b53c1d1196d13a15c5a02b566d02416716394e4cde97e04b2df6

  • SSDEEP

    3072:Ih12pjxoWVNBUNBqEVNBUNBqSV70n0yKSeRIJ9HMXktd7K:W123aNBqEaNBqv0yveRIJ9HAE7K

Score
10/10
salitybackdoorupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Processes

  • C:\Users\Admin\AppData\Local\Temp\d395fba53f8dad6a1e76add8cb7c98aad1ba99ba88658f872441e24f5845d7bbN.exe
    "C:\Users\Admin\AppData\Local\Temp\d395fba53f8dad6a1e76add8cb7c98aad1ba99ba88658f872441e24f5845d7bbN.exe"
    1⤵
      PID:2092

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2092-0-0x0000000000400000-0x0000000000431000-memory.dmp

      Filesize

      196KB

      Download

    • memory/2092-2-0x0000000000400000-0x0000000000431000-memory.dmp

      Filesize

      196KB

      Download

    • memory/2092-1-0x00000000005F0000-0x000000000167E000-memory.dmp

      Filesize

      16.6MB

      Download

    • memory/2092-3-0x00000000005F0000-0x000000000167E000-memory.dmp

      Filesize

      16.6MB

      Download