MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4720b0f4f0f0f973cc5c5e2e7c984104f1364c30c522cf0cc519543c0e5bee3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Sality


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4720b0f4f0f0f973cc5c5e2e7c984104f1364c30c522cf0cc519543c0e5bee3
SHA3-384 hash: 91edd2f55c82112e4b045f7d93654b33539a065531f8462550ca3844145ac7fe9ace8d0a9a3398df7dd0099a20c03537
SHA1 hash: 9b01b5ab1b79815518f1bde614b689deaec2ca38
MD5 hash: ec74b52408dd877e1a45f400617e10ed
humanhash: lion-indigo-lima-diet
File name:ec74b524_by_Libranalysis
Download: download sample
Signature Sality
Create hunting rule
File size:167'522 bytes
First seen:2021-05-05 10:04:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e2a592076b17ef8bfb48b7e03965a3fc (385 x GuLoader, 58 x RemcosRAT, 40 x AgentTesla)
ssdeep 3072:RIl9zpNjldDfiLuAUNRD5b4SVoVbB/9bXVd3/S9zGC4FVvmKz7y4wP7h:RKpNjlsLUjD5RVmBtXPQ74OE7y4wP7h
Threatray 16 similar samples on MalwareBazaar
TLSH 9DF3CF4177E091A6FAF207302C3767625F76BC22A9A48B0F6350375DFC32A95E939712
Reporter Libranalysis
Tags:Sality


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150286/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a file
Deleting a recently created file
Changing an executable file
Launching a process
Creating a window
Blocking a possibility to launch for the Windows Task Manager (taskmgr)
Blocking a possibility to launch for the Windows registry editor (regedit.exe)
Blocking the Windows Security Center notifications
Blocking the User Account Control
Firewall traversal
Unauthorized injection to a system process
Enabling a "Do not show hidden files" option
Enabling autorun with system ini files
Unauthorized injection to a browser process
Infecting executable files
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Sality
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1c22c232-a267-4660-8ff2-9e28af8f54d6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4720b0f4f0f0f973cc5c5e2e7c984104f1364c30c522cf0cc519543c0e5bee3/
Threat name:
Win32.Virus.Sality
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 18:38:16 UTC
AV detection:
27 of 28 (96.43%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
087df168d78dcfd730fb669aad4b848c054f08cbab3c722c87a0be0aa5c598a7
Sality
65d452037fe5b0178ba3d8b1ae2f7b556d5a06f93e1079725637251fca3875cd
Sality
71ed493c4e9ccafab61103f900b151659da8222d9982f007d013134ac615b52f
Sality
854cd8ed0a2fb46f52cf610b77191562496c88eafa088cd2980d9c21bc3e8aa1
Sality
868cba60184dd37a2f5382a7800b9bde8050f7ecbcab963db61f8517b81d413d
Sality
b7ba3f457b92a170afefec68895af36b77f72cf18438dde15318a27c3533db91
Sality
bdb1b6c2151038f1023b551d26ef4eab2d5321066d3352d5357b8bee301b67b0
Sality
ca7b714d4501ec386efecaecdd0181d83de489321ddbd38da8efeb9925dc7bef
Sality
e1e6f19a68d81013710285bdd05d864100f9c81510c3141861035d7f4e53dc81
Sality
e9f7f68eccbf03a44f620273a1091733166d66d2ec2d64bbb03119300fed543c
Sality
+ 6 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
evasion trojan upx
Link:
https://tria.ge/reports/210505-elctaksf52/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in Windows directory
Checks whether UAC is enabled
Deletes itself
Loads dropped DLL
Windows security modification
Disables RegEdit via registry modification
Disables Task Manager via registry modification
Executes dropped EXE
UPX packed file
Modifies firewall policy service
UAC bypass
Windows security bypass
Unpacked files
SH256 hash:
e37a7b6272f71bf9ff69b18537c5d34ec0a6cf9dd7bb20f32a351862b429b874
MD5 hash:
f2b5b827246807047d1d9e1b4111488b
SHA1 hash:
0fa507db30b798e4542013ee02dfcd405e8c78dd
Detections:
win_sality_auto
Create hunting rule
Link:
https://www.unpac.me/results/78ac9d33-ac6b-4a5f-a087-0b7f6984c84b/
SH256 hash:
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
MD5 hash:
17ed1c86bd67e78ade4712be48a7d2bd
SHA1 hash:
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
Link:
https://www.unpac.me/results/78ac9d33-ac6b-4a5f-a087-0b7f6984c84b/
SH256 hash:
6bf6a8f8e53c2d01649cedf8f478277e9dd5d3844697e0fc5b5c784138dd2f05
MD5 hash:
eb1ea9278ace71c1badbe8ab5c17e8d4
SHA1 hash:
5c7829f1d4f3b3566a55112a02d100d053efc255
Link:
https://www.unpac.me/results/78ac9d33-ac6b-4a5f-a087-0b7f6984c84b/
SH256 hash:
d4720b0f4f0f0f973cc5c5e2e7c984104f1364c30c522cf0cc519543c0e5bee3
MD5 hash:
ec74b52408dd877e1a45f400617e10ed
SHA1 hash:
9b01b5ab1b79815518f1bde614b689deaec2ca38
Link:
https://www.unpac.me/results/78ac9d33-ac6b-4a5f-a087-0b7f6984c84b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Sality
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/d4720b0f4f0f0f973cc5c5e2e7c984104f1364c30c522cf0cc519543c0e5bee3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_sality_g0
Create hunting rule
Author:Daniel Plohmann <daniel.plohmann<at>fkie.fraunhofer.de
Description:2013-11-11 Sality Infector

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150286/

Comments