sality

General

Target

42c08f59b3002d3bb6ec415ff7fb679fc490650da6a0fde053a4ea6b62ccda1b
Size

340KB
Sample

221003-ez486sfhd5
MD5

5942b336811dbc186531ea9000073f92
SHA1

24e0f3d5d35bc02229a0a1b3a71035217c03c050
SHA256

42c08f59b3002d3bb6ec415ff7fb679fc490650da6a0fde053a4ea6b62ccda1b
SHA512

84491049bd8f3e3072bb0b65a9bbb6816b24bcc7031dc1355a47f8ed89ebe9cbcb1fe9bc2c00207cc8676956e5236e3f95d63e23ba30732a1fe9f2adcef5cd70
SSDEEP

6144:gwxxCT+h5aZ2Un+BuUC3j57ksuuwX0Wpdx0U3KcZsxuLO/mPwELlhyJDnT:gwDW+h5VU+BuUtX09U3KZxne6nT

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  42c08f59b3002d3bb6ec415ff7fb679fc490650da6a0fde053a4ea6b62ccda1b
- Size
  
  340KB
- MD5
  
  5942b336811dbc186531ea9000073f92
- SHA1
  
  24e0f3d5d35bc02229a0a1b3a71035217c03c050
- SHA256
  
  42c08f59b3002d3bb6ec415ff7fb679fc490650da6a0fde053a4ea6b62ccda1b
- SHA512
  
  84491049bd8f3e3072bb0b65a9bbb6816b24bcc7031dc1355a47f8ed89ebe9cbcb1fe9bc2c00207cc8676956e5236e3f95d63e23ba30732a1fe9f2adcef5cd70
- SSDEEP
  
  6144:gwxxCT+h5aZ2Un+BuUC3j57ksuuwX0Wpdx0U3KcZsxuLO/mPwELlhyJDnT:gwDW+h5VU+BuUtX09U3KZxne6nT
Score

10^/10

sality backdoor bootkit discovery evasion persistence trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Deletes itself
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2