sality

General

Target

c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a.7z
Size

3.1MB
Sample

220606-rydq2sdcdq
MD5

0a5b087c39748cec335785c44d780bc8
SHA1

e91809b36a346249ebddf0b4915e83e701462640
SHA256

b6f36f8da8dfb0102f342abe6f1e17b00a90a2d3e91adadeacf0e2f23341b012
SHA512

14adadff39e0ba347bde18543a3255b9b27ffed79020b4010d9ff17db473868982f0ad3294222d4f3a5696613d7cff775930447a2f4d0fe771c7bf8bf76f736b

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a
- Size
  
  12.7MB
- MD5
  
  06b07ecce07120ffc70da9f2ab553214
- SHA1
  
  bfb2563cf8c7c2a5ce3b32acf4e7890b382e6c4e
- SHA256
  
  c05561e39ebe1e3fb489e7d38906fc7f8ac49d56f22fe6e757c0412c70a7070a
- SHA512
  
  a4cf68e455cdc046a91db56ca401ef2056fa3783bde6582bc98fbfa7b49d44a6f5290f01354179affd3f654a8f1c021ce700022c64b9ce1c41791d2b4b661598
Score

10^/10

sality backdoor evasion trojan upx discovery persistence
- Modifies firewall policy service
  evasion
- Modifies system executable filetype association
  persistence
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Suspicious use of NtCreateUserProcessOtherParentProcess
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Registers COM server for autorun
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2