sality | 1741a5140686cf2234ed0e2734c240aeec8a86923c0a544ce35c2716ef6e0cf8 | Triage

Submit
Reports

Overview

overview

Static

static

1741a51406...f8.exe

windows7-x64

1741a51406...f8.exe

windows10-2004-x64

Sharing

General

Target

1741a5140686cf2234ed0e2734c240aeec8a86923c0a544ce35c2716ef6e0cf8
Size

181KB
Sample

221010-3mnmnaedfp
MD5

7d361d4091c567d2df272cedaab75900
SHA1

cb25d11cfd5ffb34056f6a16db0391ec2956fceb
SHA256

1741a5140686cf2234ed0e2734c240aeec8a86923c0a544ce35c2716ef6e0cf8
SHA512

d8deca9641fa0762d5d6e127c94349934e8169f6c424859984185cdca6f72b86a7934c3fb5223011a1d15090d63924b3e40763d15c702327729a38baadcdb862
SSDEEP

3072:nq/fSpAbGTe2Aq/tqiqqim8SZGr3X2IPzHWhAhud9M1g1A:nqoAbgeHrmDKw0uHF1A

Score

10^/10

sality backdoor discovery evasion exploit trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

1741a5140686cf2234ed0e2734c240aeec8a86923c0a544ce35c2716ef6e0cf8.exe

Resource

win7-20220812-en

sality backdoor discovery evasion exploit trojan upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

1741a5140686cf2234ed0e2734c240aeec8a86923c0a544ce35c2716ef6e0cf8.exe

Resource

win10v2004-20220901-en

sality backdoor upx

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  1741a5140686cf2234ed0e2734c240aeec8a86923c0a544ce35c2716ef6e0cf8
- Size
  
  181KB
- MD5
  
  7d361d4091c567d2df272cedaab75900
- SHA1
  
  cb25d11cfd5ffb34056f6a16db0391ec2956fceb
- SHA256
  
  1741a5140686cf2234ed0e2734c240aeec8a86923c0a544ce35c2716ef6e0cf8
- SHA512
  
  d8deca9641fa0762d5d6e127c94349934e8169f6c424859984185cdca6f72b86a7934c3fb5223011a1d15090d63924b3e40763d15c702327729a38baadcdb862
- SSDEEP
  
  3072:nq/fSpAbGTe2Aq/tqiqqim8SZGr3X2IPzHWhAhud9M1g1A:nqoAbgeHrmDKw0uHF1A
Score

10^/10

sality backdoor discovery evasion exploit trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Possible privilege escalation attempt
  exploit
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Modifies file permissions
  discovery
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Modify Registry

Bypass User Account Control

Disabling Security Tools

File Permissions Modification

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

salitybackdoordiscoveryevasionexploittrojanupx

behavioral2

salitybackdoorupx

© 2018-2024

Terms | Privacy