sality | 840829d6d496d17d1ca41bd9812b5b847e0428c441560173c1944074cc2f7008 | Triage

Sharing

General

Target

840829d6d496d17d1ca41bd9812b5b847e0428c441560173c1944074cc2f7008
Size

104KB
Sample

221028-x9hf9schfj
MD5

000843602136177cac626340a3977cd0
SHA1

dd10fad4fc02ea6a56520f2e0174c250ca8d8fef
SHA256

840829d6d496d17d1ca41bd9812b5b847e0428c441560173c1944074cc2f7008
SHA512

d7aedb736773149e767fb8aa27089a58d3540624665e0a03a2f6814946490f1d47f2899fa82c3954af6e048eb1f8bb301ef1512128bf9a8b5f7aeb97fc016709
SSDEEP

1536:DDRmOdfCkmFXQjQNLSLsjnAN9twGxAOvMn2MQzdmMvM5KOzQ68e9B+L/DaEonvYv:rfdmxQgLSLsjYsHOvM1gEn59Q6GVOvE

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  840829d6d496d17d1ca41bd9812b5b847e0428c441560173c1944074cc2f7008
- Size
  
  104KB
- MD5
  
  000843602136177cac626340a3977cd0
- SHA1
  
  dd10fad4fc02ea6a56520f2e0174c250ca8d8fef
- SHA256
  
  840829d6d496d17d1ca41bd9812b5b847e0428c441560173c1944074cc2f7008
- SHA512
  
  d7aedb736773149e767fb8aa27089a58d3540624665e0a03a2f6814946490f1d47f2899fa82c3954af6e048eb1f8bb301ef1512128bf9a8b5f7aeb97fc016709
- SSDEEP
  
  1536:DDRmOdfCkmFXQjQNLSLsjnAN9twGxAOvMn2MQzdmMvM5KOzQ68e9B+L/DaEonvYv:rfdmxQgLSLsjYsHOvM1gEn59Q6GVOvE
Score

10^/10

sality backdoor evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorevasiontrojanupx

behavioral2