sality | ada996a88bc870e692746eff8a1c2b3fe0ad63b376369d743fcfd789095887d7 | Triage

Submit
Reports

Overview

overview

Static

static

ada996a88b...d7.exe

windows7-x64

ada996a88b...d7.exe

windows10-2004-x64

Sharing

General

Target

ada996a88bc870e692746eff8a1c2b3fe0ad63b376369d743fcfd789095887d7
Size

130KB
Sample

221014-ng26jadaek
MD5

05268a80db280b3a669afac8eec930c6
SHA1

6b475dd7bed1fffea1cabd3567963e27617c047f
SHA256

ada996a88bc870e692746eff8a1c2b3fe0ad63b376369d743fcfd789095887d7
SHA512

695866dfa63a8fe94487050a02fdc25bbed44db1f4e8221e142cb4791e31366f77b54313320a514b161e149e419e75fa208610dc8ad6f1e5e0d06b89a22fc3ca
SSDEEP

1536:7ituLRaeZvGvscwXo6PJFr0wF5iOSlQ//kZfe1IUoQkx3xMr4EJE+e6UDEHepLhy:7ii5XcQo6PfzFhqmSNx3A4EOnZGb

Score

10^/10

sality backdoor evasion trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

ada996a88bc870e692746eff8a1c2b3fe0ad63b376369d743fcfd789095887d7.exe

Resource

win7-20220901-en

sality backdoor evasion trojan upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

ada996a88bc870e692746eff8a1c2b3fe0ad63b376369d743fcfd789095887d7.exe

Resource

win10v2004-20220901-en

sality backdoor evasion trojan upx

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  ada996a88bc870e692746eff8a1c2b3fe0ad63b376369d743fcfd789095887d7
- Size
  
  130KB
- MD5
  
  05268a80db280b3a669afac8eec930c6
- SHA1
  
  6b475dd7bed1fffea1cabd3567963e27617c047f
- SHA256
  
  ada996a88bc870e692746eff8a1c2b3fe0ad63b376369d743fcfd789095887d7
- SHA512
  
  695866dfa63a8fe94487050a02fdc25bbed44db1f4e8221e142cb4791e31366f77b54313320a514b161e149e419e75fa208610dc8ad6f1e5e0d06b89a22fc3ca
- SSDEEP
  
  1536:7ituLRaeZvGvscwXo6PJFr0wF5iOSlQ//kZfe1IUoQkx3xMr4EJE+e6UDEHepLhy:7ii5XcQo6PfzFhqmSNx3A4EOnZGb
Score

10^/10

sality backdoor evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorevasiontrojanupx

behavioral2

salitybackdoorevasiontrojanupx

© 2018-2025

Terms | Privacy