sality | 30ea4cda531ea2ea2a7f2b5494fcc830e623518862c48852a4b1e3b03c071f95 | Triage

Submit
Reports

Overview

overview

Static

static

30ea4cda53...95.exe

windows7-x64

30ea4cda53...95.exe

windows10-2004-x64

Sharing

General

Target

30ea4cda531ea2ea2a7f2b5494fcc830e623518862c48852a4b1e3b03c071f95
Size

177KB
Sample

221021-nt6dqaacam
MD5

22408f36bd6db96d30c5bb149b3050e0
SHA1

e184eeb125c465dfa2b1a721ad89b45ce0cf3801
SHA256

30ea4cda531ea2ea2a7f2b5494fcc830e623518862c48852a4b1e3b03c071f95
SHA512

743f21a1ee68de71eaf52c0e7d91db9c5826e37ea0c3b98a11d662c2aa536e96e60a859a8abb69683bf87589d903e3e2772000827268270b0cfdb810d5ea2198
SSDEEP

3072:Yq/HSpAbGTe2Aq/tqiI09Gp7ifqtTyOWZS7wB7gUkIjr7aF1A:YqQAbge6Gp79Wc7pIjr7aF1A

Score

10^/10

sality backdoor discovery evasion exploit trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

30ea4cda531ea2ea2a7f2b5494fcc830e623518862c48852a4b1e3b03c071f95.exe

Resource

win7-20220812-en

sality backdoor discovery evasion exploit trojan upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

30ea4cda531ea2ea2a7f2b5494fcc830e623518862c48852a4b1e3b03c071f95.exe

Resource

win10v2004-20220812-en

sality backdoor evasion trojan upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  30ea4cda531ea2ea2a7f2b5494fcc830e623518862c48852a4b1e3b03c071f95
- Size
  
  177KB
- MD5
  
  22408f36bd6db96d30c5bb149b3050e0
- SHA1
  
  e184eeb125c465dfa2b1a721ad89b45ce0cf3801
- SHA256
  
  30ea4cda531ea2ea2a7f2b5494fcc830e623518862c48852a4b1e3b03c071f95
- SHA512
  
  743f21a1ee68de71eaf52c0e7d91db9c5826e37ea0c3b98a11d662c2aa536e96e60a859a8abb69683bf87589d903e3e2772000827268270b0cfdb810d5ea2198
- SSDEEP
  
  3072:Yq/HSpAbGTe2Aq/tqiI09Gp7ifqtTyOWZS7wB7gUkIjr7aF1A:YqQAbge6Gp79Wc7pIjr7aF1A
Score

10^/10

sality backdoor discovery evasion exploit trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Possible privilege escalation attempt
  exploit
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Modifies file permissions
  discovery
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Modify Registry

Bypass User Account Control

Disabling Security Tools

File Permissions Modification

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

salitybackdoordiscoveryevasionexploittrojanupx

behavioral2

salitybackdoorevasiontrojanupx

© 2018-2024

Terms | Privacy