sality | 4e42e59d7ba81ab8a880aa589c520dea8fcadaeb11569f2612e89e2e53c00ec7 | Triage

Submit
Reports

Overview

overview

Static

static

4e42e59d7b...c7.exe

windows7-x64

4e42e59d7b...c7.exe

windows10-2004-x64

Sharing

General

Target

4e42e59d7ba81ab8a880aa589c520dea8fcadaeb11569f2612e89e2e53c00ec7
Size

173KB
Sample

221108-crzydacbg9
MD5

0b40102a3f7409b7189e91d2ebad4480
SHA1

77bf14d71a234326c0168d7042bdb9af68a4ef56
SHA256

4e42e59d7ba81ab8a880aa589c520dea8fcadaeb11569f2612e89e2e53c00ec7
SHA512

7596a6d9d598f726968ad9cddd776264f1393d8eead04b75dcdd6466817345ce5f5cacef935ad4271d17210f8b7616a6e56e394b3a0c532629f4070980333e53
SSDEEP

3072:Fq/bSpAbGTe2Aq/tqiBQOFugPY4j5+115fRxuyG/SE9vMd1A:Fq0Abge9OFugPY4215ZHEDyd1A

Score

10^/10

sality backdoor discovery evasion exploit trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

4e42e59d7ba81ab8a880aa589c520dea8fcadaeb11569f2612e89e2e53c00ec7.exe

Resource

win7-20220812-en

sality backdoor discovery evasion exploit trojan upx

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

4e42e59d7ba81ab8a880aa589c520dea8fcadaeb11569f2612e89e2e53c00ec7.exe

Resource

win10v2004-20220812-en

sality backdoor upx

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  4e42e59d7ba81ab8a880aa589c520dea8fcadaeb11569f2612e89e2e53c00ec7
- Size
  
  173KB
- MD5
  
  0b40102a3f7409b7189e91d2ebad4480
- SHA1
  
  77bf14d71a234326c0168d7042bdb9af68a4ef56
- SHA256
  
  4e42e59d7ba81ab8a880aa589c520dea8fcadaeb11569f2612e89e2e53c00ec7
- SHA512
  
  7596a6d9d598f726968ad9cddd776264f1393d8eead04b75dcdd6466817345ce5f5cacef935ad4271d17210f8b7616a6e56e394b3a0c532629f4070980333e53
- SSDEEP
  
  3072:Fq/bSpAbGTe2Aq/tqiBQOFugPY4j5+115fRxuyG/SE9vMd1A:Fq0Abge9OFugPY4215ZHEDyd1A
Score

10^/10

sality backdoor discovery evasion exploit trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Possible privilege escalation attempt
  exploit
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Modifies file permissions
  discovery
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Modify Registry

Bypass User Account Control

Disabling Security Tools

File Permissions Modification

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

salitybackdoordiscoveryevasionexploittrojanupx

behavioral2

salitybackdoorupx

© 2018-2024

Terms | Privacy