sality | 60e2d922f8175e1a5ab0911e52e27a08445a4cb8fd216523d8abf8e6f23976e6 | Triage

Submit
Reports

Overview

overview

Static

static

60e2d922f8...e6.exe

windows7-x64

60e2d922f8...e6.exe

windows10-2004-x64

Sharing

General

Target

60e2d922f8175e1a5ab0911e52e27a08445a4cb8fd216523d8abf8e6f23976e6
Size

173KB
Sample

221030-b9hw5sgfgp
MD5

a325e5bffbb391a2f17a2023bf10e480
SHA1

1bd2fbf9764fe5210dad63d0f1c5a3a949c87b17
SHA256

60e2d922f8175e1a5ab0911e52e27a08445a4cb8fd216523d8abf8e6f23976e6
SHA512

67f77bdbd0ea22668298e4c1779199439457d2b054b138cc18576558da4c403412fe67ab3852ec7838e3755c29918a674eac146e94a3320e253238d5f0e8af75
SSDEEP

3072:Iq/BSpAbGTe2Aq/tqi8X/h3RrP8CaH5glXqeR/e2Wo9v1A:IqKAbge/XVRr0CaH5KXqefWIv1A

Score

10^/10

sality backdoor discovery evasion exploit trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

60e2d922f8175e1a5ab0911e52e27a08445a4cb8fd216523d8abf8e6f23976e6.exe

Resource

win7-20220901-en

sality backdoor discovery evasion exploit trojan upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

60e2d922f8175e1a5ab0911e52e27a08445a4cb8fd216523d8abf8e6f23976e6.exe

Resource

win10v2004-20220812-en

sality backdoor evasion trojan upx

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  60e2d922f8175e1a5ab0911e52e27a08445a4cb8fd216523d8abf8e6f23976e6
- Size
  
  173KB
- MD5
  
  a325e5bffbb391a2f17a2023bf10e480
- SHA1
  
  1bd2fbf9764fe5210dad63d0f1c5a3a949c87b17
- SHA256
  
  60e2d922f8175e1a5ab0911e52e27a08445a4cb8fd216523d8abf8e6f23976e6
- SHA512
  
  67f77bdbd0ea22668298e4c1779199439457d2b054b138cc18576558da4c403412fe67ab3852ec7838e3755c29918a674eac146e94a3320e253238d5f0e8af75
- SSDEEP
  
  3072:Iq/BSpAbGTe2Aq/tqi8X/h3RrP8CaH5glXqeR/e2Wo9v1A:IqKAbge/XVRr0CaH5KXqefWIv1A
Score

10^/10

sality backdoor discovery evasion exploit trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Possible privilege escalation attempt
  exploit
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Modifies file permissions
  discovery
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Modify Registry

Bypass User Account Control

Disabling Security Tools

File Permissions Modification

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

salitybackdoordiscoveryevasionexploittrojanupx

behavioral2

salitybackdoorevasiontrojanupx

© 2018-2024

Terms | Privacy