MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 71ed493c4e9ccafab61103f900b151659da8222d9982f007d013134ac615b52f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Sality
Vendor detections: 7
| SHA256 hash: | 71ed493c4e9ccafab61103f900b151659da8222d9982f007d013134ac615b52f |
|---|---|
| SHA3-384 hash: | 6b720a5b42890d2c0d75a40a9b46104da992a5608b757d9d17fae3f38ba4134a4f92d4991b57fcf4b879e0a0640f49bb |
| SHA1 hash: | ed240df74abfaab82251a921940380a05696eae5 |
| MD5 hash: | fd2a937833bdc0470389402139a7b44b |
| humanhash: | asparagus-table-summer-stairway |
| File name: | fd2a9378_by_Libranalysis |
| Download: | download sample |
| Signature | Sality |
| File size: | 845'016 bytes |
| First seen: | 2021-05-05 08:01:45 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 092eb6daba2f17cbda102fd1a32acd00 (1 x Sality) |
| ssdeep | 24576:EYrpmmY0Vm+CupW/0+dlTcknzosoeEwL:EYlbVVm+nWRl4I5 |
| Threatray | 4 similar samples on MalwareBazaar |
| TLSH | EA052302058FC18CD196AA37217B5D5BAC7FB8840B1B43BA16C55CCEC63A761ECF971A |
| Reporter |  Libranalysis |
| Tags: | Sality |
Intelligence
File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a file
Creating a process from a recently created file
Launching a process
Creating a file in the Windows directory
Sending a UDP request
Changing an executable file
Modifying an executable file
Deleting a recently created file
Enabling the 'hidden' option for recently created files
Blocking the User Account Control
Firewall traversal
Unauthorized injection to a system process
Unauthorized injection to a recently created process
Creating a file in the mass storage device
Blocking a possibility to launch for the Windows Task Manager (taskmgr)
Blocking a possibility to launch for the Windows registry editor (regedit.exe)
Blocking the Windows Security Center notifications
Enabling a "Do not show hidden files" option
Enabling autorun with system ini files
Unauthorized injection to a browser process
Infecting executable files
Enabling threat expansion on mass storage devices by creating the autorun.inf autorun file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
Win32.Virus.Sality
Status:
Malicious
First seen:
2020-05-05 19:42:37 UTC
AV detection:
28 of 29 (96.55%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
Result
Malware family:
n/a
Score:
10/10
Tags:
evasion trojan upx
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Drops file in Windows directory
Checks whether UAC is enabled
Enumerates connected drives
Loads dropped DLL
Windows security modification
Disables RegEdit via registry modification
Disables Task Manager via registry modification
Executes dropped EXE
UPX packed file
Modifies firewall policy service
UAC bypass
Windows security bypass
Unpacked files
SH256 hash:
d28204eb5d1739502364ee054fcfb653728b98cc6da3aae297a57894b1248960
MD5 hash:
8b4e3d9bc06c40d85861a8aefc3f41d6
SHA1 hash:
ce9b0097f5aa6b4c2eff673942a8a5b7fb3aa870
SH256 hash:
03c71c59ff21a38706d77593e34be17b8bc81627c96b4927c2d5a59d84fbc8a3
MD5 hash:
5c757b24b2ca7f311e00c59f6689fe48
SHA1 hash:
3ac28e47ef6e0176f8d5986cb2b9d0b67b3950a2
Detections:
win_sality_auto
Parent samples :
65d452037fe5b0178ba3d8b1ae2f7b556d5a06f93e1079725637251fca3875cd
71ed493c4e9ccafab61103f900b151659da8222d9982f007d013134ac615b52f
bf22f585232c8fb2549d03c279becd4d3b761282dc0f62f3e367a9a9f1d415c7
868cba60184dd37a2f5382a7800b9bde8050f7ecbcab963db61f8517b81d413d
b7ba3f457b92a170afefec68895af36b77f72cf18438dde15318a27c3533db91
e1e6f19a68d81013710285bdd05d864100f9c81510c3141861035d7f4e53dc81
e894aaa26f75cc07ecdee02a0ed31f666382ef51efe6ed41bac5e77ac3b4d9ed
71ed493c4e9ccafab61103f900b151659da8222d9982f007d013134ac615b52f
bf22f585232c8fb2549d03c279becd4d3b761282dc0f62f3e367a9a9f1d415c7
868cba60184dd37a2f5382a7800b9bde8050f7ecbcab963db61f8517b81d413d
b7ba3f457b92a170afefec68895af36b77f72cf18438dde15318a27c3533db91
e1e6f19a68d81013710285bdd05d864100f9c81510c3141861035d7f4e53dc81
e894aaa26f75cc07ecdee02a0ed31f666382ef51efe6ed41bac5e77ac3b4d9ed
SH256 hash:
1f97cf7710c705c9b7ebb476e5526322aa0f0e5f0607c9f71be20885fc34cb68
MD5 hash:
97736c706953f7fe6b3818a25b9e1125
SHA1 hash:
9ccf21d8f283e53c038027eb4c8dbf70c00fc313
SH256 hash:
1f80fcfd93a11a671c654f401eb1b90925a89bbb21a5e28409f88bc74475eb04
MD5 hash:
bc84905563e8e91e0f819d70d3b0690a
SHA1 hash:
03500b9f967254c0540f6e60065657884d8d47b6
SH256 hash:
71ed493c4e9ccafab61103f900b151659da8222d9982f007d013134ac615b52f
MD5 hash:
fd2a937833bdc0470389402139a7b44b
SHA1 hash:
ed240df74abfaab82251a921940380a05696eae5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | suspicious_packer_section |
|---|---|
| Author: | @j0sm1 |
| Description: | The packer/protector section names/keywords |
| Reference: | http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/ |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.