MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 868cba60184dd37a2f5382a7800b9bde8050f7ecbcab963db61f8517b81d413d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Sality


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 868cba60184dd37a2f5382a7800b9bde8050f7ecbcab963db61f8517b81d413d
SHA3-384 hash: cb8281e51e33b595174e80d9e292d2f79eef20cd491a818580163daef900b3346210c64698dc42c974b03c2507ab50d7
SHA1 hash: 2d37a3afe409d962cfbae4893e2aa12cf0242ad7
MD5 hash: dab873af85010cb3afff3ef827de4f9e
humanhash: connecticut-nebraska-lemon-twelve
File name:dab873af_by_Libranalysis
Download: download sample
Signature Sality
Create hunting rule
File size:112'552 bytes
First seen:2021-05-05 09:07:46 UTC
Last seen:2021-05-05 10:05:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9c523d8653da5455667e3f82274f2f88 (6 x Formbook, 2 x SnakeKeylogger, 1 x AZORult)
ssdeep 3072:AbLpwuEskJeejv4f45/eorVM94RWAGq7TPwP:AbTNs4fEFRWAGq7TYP
Threatray 14 similar samples on MalwareBazaar
TLSH E6B3E016BBC8D4B7CB93427294B2F33BD7B793980643519327504FAEF9E02C6DA15096
Reporter Libranalysis
Tags:Sality


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
2
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150217/
Detection(s):
SecuriteInfo.com.Win32.Sector.30.18730.31481.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Changing an executable file
Modifying an executable file
Creating a file in the %temp% directory
Deleting a recently created file
Sending a UDP request
Creating a file
Enabling the 'hidden' option for recently created files
Blocking a possibility to launch for the Windows Task Manager (taskmgr)
Blocking a possibility to launch for the Windows registry editor (regedit.exe)
Blocking the Windows Security Center notifications
Blocking the User Account Control
Firewall traversal
Unauthorized injection to a system process
Creating a file in the mass storage device
Enabling a "Do not show hidden files" option
Enabling autorun with system ini files
Unauthorized injection to a browser process
Infecting executable files
Enabling threat expansion on mass storage devices by creating the autorun.inf autorun file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Sality
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fa505fff-a6cc-47b8-933e-4ccb757f17c5
Result
Threat name:
Sality
Create hunting rule
Detection:
malicious
Classification:
spre.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/711740
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Deletes keys which are related to windows safe boot (disables safe mode boot)
Disables the Windows registry editor (regedit)
Disables the Windows task manager (taskmgr)
Disables user account control notifications
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
May modify the system service descriptor table (often done to hook functions)
Modifies the windows firewall
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Writes to foreign memory regions
Yara detected Sality
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/868cba60184dd37a2f5382a7800b9bde8050f7ecbcab963db61f8517b81d413d/
Threat name:
Win32.Virus.Sality
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 19:51:50 UTC
AV detection:
31 of 31 (100.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
087df168d78dcfd730fb669aad4b848c054f08cbab3c722c87a0be0aa5c598a7
Sality
3bd940aa8cce3f10808d20494f3f10b34502a14321ea9bb50123016d82c2203f
Sality
65d452037fe5b0178ba3d8b1ae2f7b556d5a06f93e1079725637251fca3875cd
Sality
71ed493c4e9ccafab61103f900b151659da8222d9982f007d013134ac615b52f
Sality
a618654d80abab200243945d1fb26204acb5bcc6e145656b8fb7152d8ab6a52e
Sality
b7ba3f457b92a170afefec68895af36b77f72cf18438dde15318a27c3533db91
Sality
bdb1b6c2151038f1023b551d26ef4eab2d5321066d3352d5357b8bee301b67b0
Sality
ca7b714d4501ec386efecaecdd0181d83de489321ddbd38da8efeb9925dc7bef
Sality
e9f7f68eccbf03a44f620273a1091733166d66d2ec2d64bbb03119300fed543c
Sality
fe4a428be1083fac733455dd141fe876d2943b8b12916f4958bd45eba1d0f23e
Sality
+ 4 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion trojan upx
Link:
https://tria.ge/reports/210505-2srcs41b6s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Drops file in Windows directory
Checks whether UAC is enabled
Windows security modification
Disables RegEdit via registry modification
Disables Task Manager via registry modification
UPX packed file
Modifies firewall policy service
UAC bypass
Windows security bypass
Unpacked files
SH256 hash:
71968aa45d70a79940067913f555e2d755b06222dd9a25226d461ada80e5aabc
MD5 hash:
cc9aa9e8dcb97903aac6e6b94cbf117a
SHA1 hash:
f5a31dd13e97fa118fdf8aa85971d7302f1e3932
Link:
https://www.unpac.me/results/13a72cff-5ae4-4b86-a023-05ba5e694504/
SH256 hash:
03c71c59ff21a38706d77593e34be17b8bc81627c96b4927c2d5a59d84fbc8a3
MD5 hash:
5c757b24b2ca7f311e00c59f6689fe48
SHA1 hash:
3ac28e47ef6e0176f8d5986cb2b9d0b67b3950a2
Detections:
win_sality_auto
Create hunting rule
Link:
https://www.unpac.me/results/13a72cff-5ae4-4b86-a023-05ba5e694504/
Parent samples :
65d452037fe5b0178ba3d8b1ae2f7b556d5a06f93e1079725637251fca3875cd
71ed493c4e9ccafab61103f900b151659da8222d9982f007d013134ac615b52f
bf22f585232c8fb2549d03c279becd4d3b761282dc0f62f3e367a9a9f1d415c7
868cba60184dd37a2f5382a7800b9bde8050f7ecbcab963db61f8517b81d413d
b7ba3f457b92a170afefec68895af36b77f72cf18438dde15318a27c3533db91
e1e6f19a68d81013710285bdd05d864100f9c81510c3141861035d7f4e53dc81
e894aaa26f75cc07ecdee02a0ed31f666382ef51efe6ed41bac5e77ac3b4d9ed
SH256 hash:
d0013021e51bc6fdeca407cb61406a63b853575145d09d2012fb254e82d6ecce
MD5 hash:
95d68b24a91a4bb6453bc4f350a58c5a
SHA1 hash:
3987f9da4ddf3d81e703997e55b1f349f26f6fc0
Link:
https://www.unpac.me/results/13a72cff-5ae4-4b86-a023-05ba5e694504/
SH256 hash:
868cba60184dd37a2f5382a7800b9bde8050f7ecbcab963db61f8517b81d413d
MD5 hash:
dab873af85010cb3afff3ef827de4f9e
SHA1 hash:
2d37a3afe409d962cfbae4893e2aa12cf0242ad7
Link:
https://www.unpac.me/results/13a72cff-5ae4-4b86-a023-05ba5e694504/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_sality_g0
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann<at>fkie.fraunhofer.de
Description:2013-11-11 Sality Infector

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150217/

Comments