sality | 113bdc00b5f913ce895ee9613ac6d765b6e0496114320658675c0fe0fdd507b0 | Triage

Submit
Reports

Overview

overview

Static

static

113bdc00b5...b0.exe

windows7_x64

3

113bdc00b5...b0.exe

windows10-2004_x64

Sharing

General

Target

113bdc00b5f913ce895ee9613ac6d765b6e0496114320658675c0fe0fdd507b0
Size

190KB
Sample

220604-jjx75shegp
MD5

45a78f715431fffa6ba88a3a726a9362
SHA1

318ab463901bfbe97f225ccbfa537ba11ea80b57
SHA256

113bdc00b5f913ce895ee9613ac6d765b6e0496114320658675c0fe0fdd507b0
SHA512

9941da7f05de0be2b83d5a6b92a22a89aa90494a89b034fec8f8907f75888481504c7b623bfa4143d55db473386c19bf006e1dbbef6ba5b4ae6f8f4280bab1e6

Score

10^/10

sality backdoor evasion trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

113bdc00b5f913ce895ee9613ac6d765b6e0496114320658675c0fe0fdd507b0.exe

Resource

win7-20220414-en

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

113bdc00b5f913ce895ee9613ac6d765b6e0496114320658675c0fe0fdd507b0.exe

Resource

win10v2004-20220414-en

sality backdoor evasion trojan upx

windows10-2004_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  113bdc00b5f913ce895ee9613ac6d765b6e0496114320658675c0fe0fdd507b0
- Size
  
  190KB
- MD5
  
  45a78f715431fffa6ba88a3a726a9362
- SHA1
  
  318ab463901bfbe97f225ccbfa537ba11ea80b57
- SHA256
  
  113bdc00b5f913ce895ee9613ac6d765b6e0496114320658675c0fe0fdd507b0
- SHA512
  
  9941da7f05de0be2b83d5a6b92a22a89aa90494a89b034fec8f8907f75888481504c7b623bfa4143d55db473386c19bf006e1dbbef6ba5b4ae6f8f4280bab1e6
Score

10^/10

sality backdoor evasion trojan upx
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

salitybackdoorevasiontrojanupx

© 2018-2024

Terms | Privacy