sality | d078870493022685025e69eb247ebd07b8fdab09e15cd6b4ce38b022a9883d5c | Triage

Submit
Reports

Overview

overview

Static

static

d078870493...5c.exe

windows7-x64

d078870493...5c.exe

windows10-2004-x64

Sharing

General

Target

d078870493022685025e69eb247ebd07b8fdab09e15cd6b4ce38b022a9883d5c
Size

881KB
Sample

221123-tehxrsgh6w
MD5

535bf92fc36d15e1efad72df8f841fa6
SHA1

a9d5a3fb2fbac952dce815eb1f11866092d82667
SHA256

d078870493022685025e69eb247ebd07b8fdab09e15cd6b4ce38b022a9883d5c
SHA512

32f345a47fe049902f9d6d759940d69983aafcdcc055cde9cf444fe35c9f74903840061b6eb1c4b9473e2138d5d299844372c2e52029f75179803e8d99fdd728
SSDEEP

12288:zaBStl2ur7lYLD4eR48zJCBxxWKqDEHQf/XRP9w9C2wg/dw3eVpTfmh6LcZx38:zaU3Jy34D8zJCBxxWzJw9T1tTQF4

Score

10^/10

sality backdoor evasion trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

d078870493022685025e69eb247ebd07b8fdab09e15cd6b4ce38b022a9883d5c.exe

Resource

win7-20220812-en

sality backdoor evasion trojan upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

d078870493022685025e69eb247ebd07b8fdab09e15cd6b4ce38b022a9883d5c.exe

Resource

win10v2004-20220812-en

sality backdoor evasion trojan upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  d078870493022685025e69eb247ebd07b8fdab09e15cd6b4ce38b022a9883d5c
- Size
  
  881KB
- MD5
  
  535bf92fc36d15e1efad72df8f841fa6
- SHA1
  
  a9d5a3fb2fbac952dce815eb1f11866092d82667
- SHA256
  
  d078870493022685025e69eb247ebd07b8fdab09e15cd6b4ce38b022a9883d5c
- SHA512
  
  32f345a47fe049902f9d6d759940d69983aafcdcc055cde9cf444fe35c9f74903840061b6eb1c4b9473e2138d5d299844372c2e52029f75179803e8d99fdd728
- SSDEEP
  
  12288:zaBStl2ur7lYLD4eR48zJCBxxWKqDEHQf/XRP9w9C2wg/dw3eVpTfmh6LcZx38:zaU3Jy34D8zJCBxxWzJw9T1tTQF4
Score

10^/10

sality backdoor evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorevasiontrojanupx

behavioral2

salitybackdoorevasiontrojanupx

© 2018-2024

Terms | Privacy