Overview

overview

10

Static

static

3

363ecffc5b...c7.exe

windows7-x64

10

363ecffc5b...c7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    363ecffc5be8bafacf76d39495a34e285f9608479e46cc562ea0739cba4dc0c7

  • Size

    6.3MB

  • Sample

    240701-y768aaxfnc

  • MD5

    b0bd17e3c1447a1f1ad35fddc5007f26

  • SHA1

    7ceb51392d32f113f07300c636112bc311330e38

  • SHA256

    363ecffc5be8bafacf76d39495a34e285f9608479e46cc562ea0739cba4dc0c7

  • SHA512

    707afbec914a32c6285db891f78ae47ded8d24befc72ca71b994b3fb2dce2e31efa002a3c24d904a526040a76c77cb19448e06694c2b54c4cefa206a7c5da95c

  • SSDEEP

    196608:EYub1Ls+UIUwgT4Ot8DS2Dpcbw7lgssa4B:Tub1avPF8JYGlgsjI

Score
10/10
salitybackdoordiscoveryevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      363ecffc5be8bafacf76d39495a34e285f9608479e46cc562ea0739cba4dc0c7

    • Size

      6.3MB

    • MD5

      b0bd17e3c1447a1f1ad35fddc5007f26

    • SHA1

      7ceb51392d32f113f07300c636112bc311330e38

    • SHA256

      363ecffc5be8bafacf76d39495a34e285f9608479e46cc562ea0739cba4dc0c7

    • SHA512

      707afbec914a32c6285db891f78ae47ded8d24befc72ca71b994b3fb2dce2e31efa002a3c24d904a526040a76c77cb19448e06694c2b54c4cefa206a7c5da95c

    • SSDEEP

      196608:EYub1Ls+UIUwgT4Ot8DS2Dpcbw7lgssa4B:Tub1avPF8JYGlgsjI

    Score
    10/10
    salitybackdoorevasiontrojanupxdiscovery

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

    • UPX dump on OEP (original entry point)

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Defense Evasion

Modify Registry

5
T1112

Impair Defenses

4
T1562

Disable or Modify Tools

3
T1562.001

Disable or Modify System Firewall

1
T1562.004

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks