sality

General

Target

faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219
Size

879KB
Sample

220605-3ec6ysheej
MD5

d5a7988e6119ee2b3c3595c489ded95b
SHA1

585a3dc03f1267bfd12533bc43ea19565ccae661
SHA256

faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219
SHA512

d4c9ad2e7e217b848b16860472ed9ea57cd28deb341701e1ae7e7b4418b11a4fa9ba7626723ea6c9ef6caf42e87e2ec635a142470e460eee51811d18d4f0c55e

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219
- Size
  
  879KB
- MD5
  
  d5a7988e6119ee2b3c3595c489ded95b
- SHA1
  
  585a3dc03f1267bfd12533bc43ea19565ccae661
- SHA256
  
  faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219
- SHA512
  
  d4c9ad2e7e217b848b16860472ed9ea57cd28deb341701e1ae7e7b4418b11a4fa9ba7626723ea6c9ef6caf42e87e2ec635a142470e460eee51811d18d4f0c55e
Score

10^/10

sality backdoor discovery evasion suricata trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- suricata: ET MALWARE Known Hostile Domain ant.trenz .pl Lookup
  suricata: ET MALWARE Known Hostile Domain ant.trenz .pl Lookup
  suricata
- suricata: ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup
  suricata: ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup
  suricata
- suricata: ET MALWARE Win32.Sality-GR Checkin
  suricata: ET MALWARE Win32.Sality-GR Checkin
  suricata
- Contacts a large (808) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Contacts a large (907) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2