sality | f3dda8f48606c448d22a7b407f61757605acc028d3deddd0ad8c1e2742efcf86 | Triage

Sharing

General

Target

b277141c357912e3cf76cf2eff36d2d9.exe
Size

2.9MB
Sample

210724-s182c5m3zn
MD5

b277141c357912e3cf76cf2eff36d2d9
SHA1

dfee214eec9da65da55ce47f44ccb0ae4751195e
SHA256

f3dda8f48606c448d22a7b407f61757605acc028d3deddd0ad8c1e2742efcf86
SHA512

11aad22541baeeb19f54b306b3719da789287ce5ad2aec9218c2b305b69d4bd8fe794063fab761ce5f90a02ffb506ed9b2431966a2e9aa605647508f5326159b

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  b277141c357912e3cf76cf2eff36d2d9.exe
- Size
  
  2.9MB
- MD5
  
  b277141c357912e3cf76cf2eff36d2d9
- SHA1
  
  dfee214eec9da65da55ce47f44ccb0ae4751195e
- SHA256
  
  f3dda8f48606c448d22a7b407f61757605acc028d3deddd0ad8c1e2742efcf86
- SHA512
  
  11aad22541baeeb19f54b306b3719da789287ce5ad2aec9218c2b305b69d4bd8fe794063fab761ce5f90a02ffb506ed9b2431966a2e9aa605647508f5326159b
Score

10^/10

evasion trojan sality backdoor upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Modify Registry

Bypass User Account Control

Disabling Security Tools

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

salitybackdoorevasiontrojanupx