MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 513c36f4a21c7ebf125fe36b98fb2c065898b9f543a6e8dbbf3f9a041c5b86fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Sality
Vendor detections: 10
| SHA256 hash: | 513c36f4a21c7ebf125fe36b98fb2c065898b9f543a6e8dbbf3f9a041c5b86fa |
|---|---|
| SHA3-384 hash: | faa132761c8002c8fc0becebd6d206ca2cee907228b84bfcf28f318d7b9d078d5ced8c5327a45a4475ab63ffd590450d |
| SHA1 hash: | 0afaf454daa59ab4d5af84f20d46b6ede83df3aa |
| MD5 hash: | 06520d039dc1372fec03e88669785ae0 |
| humanhash: | spaghetti-mirror-harry-charlie |
| File name: | Fasapos.exe |
| Download: | download sample |
| Signature | Sality |
| File size: | 3'975'860 bytes |
| First seen: | 2021-09-26 20:15:30 UTC |
| Last seen: | 2021-09-26 20:54:50 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 40fdc4e2cc94595a56f938f76fbbbe8a (1 x Sality) |
| ssdeep | 98304:W54jkQCe975yiajT112vfDEe18f7SDFn7:C4jkQCe97wiajZ12rF7 |
| Threatray | 30 similar samples on MalwareBazaar |
| TLSH | T1EA06122A374B4C0F58D8686F210E2ADB9AEF5C6EC001FE96E56971369D31B774D0C887 |
| File icon (PE): |  |
| dhash icon | 0a0696cccae0f430 (1 x Sality) |
| Reporter |  Glaive |
| Tags: | exe Sality |
Intelligence
File Origin
# of uploads :
2
# of downloads :
250
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Fasapos.exe
Verdict:
Malicious activity
Analysis date:
2021-09-26 20:16:50 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Launching a service
Creating a window
Deleting a recently created file
Changing an executable file
Modifying an executable file
Creating a file
Enabling the 'hidden' option for recently created files
Blocking a possibility to launch for the Windows Task Manager (taskmgr)
Blocking a possibility to launch for the Windows registry editor (regedit.exe)
Blocking the Windows Security Center notifications
Blocking the User Account Control
Firewall traversal
Creating a file in the mass storage device
Enabling a "Do not show hidden files" option
Enabling autorun with system ini files
Unauthorized injection to a system process
Unauthorized injection to a browser process
Infecting executable files
Enabling threat expansion on mass storage devices by creating the autorun.inf autorun file
Malware family:
Sality
Verdict:
Malicious
Result
Threat name:
Sality
Detection:
malicious
Classification:
spre.evad
Score:
100 / 100
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to inject threads in other processes
Deletes keys which are related to windows safe boot (disables safe mode boot)
Disables the Windows registry editor (regedit)
Disables the Windows task manager (taskmgr)
Disables UAC (registry)
Disables user account control notifications
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
May modify the system service descriptor table (often done to hook functions)
Modifies the windows firewall
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Sigma detected: Suspicious Svchost Process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected Sality
Behaviour
Behavior Graph:
Threat name:
Win32.Virus.Sality
Status:
Malicious
First seen:
2021-09-26 20:16:04 UTC
AV detection:
41 of 45 (91.11%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 20 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
10/10
Tags:
evasion trojan upx
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Drops file in Windows directory
Checks whether UAC is enabled
Enumerates connected drives
Windows security modification
Disables RegEdit via registry modification
Disables Task Manager via registry modification
UPX packed file
Modifies firewall policy service
UAC bypass
Windows security bypass
Unpacked files
SH256 hash:
44cd1eb3bd11267f88e393014b8f1bf6da9025d9b2c75ecbb19c8faef2cfab01
MD5 hash:
a2ebf97998d90c0b145692c1037876be
SHA1 hash:
63e6a786f0d90ab8dad09a73f93822fcb82d9169
SH256 hash:
8ec28b718336a05245f2138cbcc4fea8e45f698a40bfc6fd79162adf67333e8b
MD5 hash:
dd09ad8e04a5595e859234824b326894
SHA1 hash:
b6b7fe689a9d30d884d8fa96d2969fdc195d2869
Detections:
win_sality_auto
Parent samples :
513c36f4a21c7ebf125fe36b98fb2c065898b9f543a6e8dbbf3f9a041c5b86fa
25cccd07f6b6e3a314f78830308864675c5c18ee42a69db5cacdceb0b754acb4
659f26b02937b33a8cfaee03ef2a1d9d4a5818580540d1b3ceafe3cd2df34fdd
e21addfbc364c309bf5408cd977d44a6d683f9f4997c4154fbbc56e6dc54a162
5b6430e115eb28e10d4e38f3cf311fd9fd39b358ab0dcd6d7ff49bf9d01dab3a
25cccd07f6b6e3a314f78830308864675c5c18ee42a69db5cacdceb0b754acb4
659f26b02937b33a8cfaee03ef2a1d9d4a5818580540d1b3ceafe3cd2df34fdd
e21addfbc364c309bf5408cd977d44a6d683f9f4997c4154fbbc56e6dc54a162
5b6430e115eb28e10d4e38f3cf311fd9fd39b358ab0dcd6d7ff49bf9d01dab3a
SH256 hash:
047048a21fb5f3e37c73483ac901c875b83a4254dbafedfbd433f7639195fc47
MD5 hash:
ec2b9fdcf0fedb4ee772ca334151527e
SHA1 hash:
76a420923ce64f7f2564400ead5c13bcd6d65860
SH256 hash:
513c36f4a21c7ebf125fe36b98fb2c065898b9f543a6e8dbbf3f9a041c5b86fa
MD5 hash:
06520d039dc1372fec03e88669785ae0
SHA1 hash:
0afaf454daa59ab4d5af84f20d46b6ede83df3aa
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.