sality | 4d3252da2883ac8d942f3d3a43efdb0648e441224e7ff09a011ffab5ed54ca80 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4d3252da2883ac8d942f3d3a43efdb0648e441224e7ff09a011ffab5ed54ca80
Size

266KB
Sample

221123-wwzyqaga9y
MD5

431417843f1027cc0f886f9df371d1f0
SHA1

d3c4980a3ca0ab1ba1978f2c24858473de69ba3e
SHA256

4d3252da2883ac8d942f3d3a43efdb0648e441224e7ff09a011ffab5ed54ca80
SHA512

1a43125758cdefc3cc815cdc768d9dc5e3f4ed373a0e24d16b18dfcb52f6e92224fa88ae33459f772d3e7d506bf9536f36897ebfcb9aeda0e4246c03f4d0f2d6
SSDEEP

6144:1SPV4MyG0KNuVDOomiWKYzz4jKW9YSTL4:I/UKNISPpTzz0jYUL4

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  4d3252da2883ac8d942f3d3a43efdb0648e441224e7ff09a011ffab5ed54ca80
- Size
  
  266KB
- MD5
  
  431417843f1027cc0f886f9df371d1f0
- SHA1
  
  d3c4980a3ca0ab1ba1978f2c24858473de69ba3e
- SHA256
  
  4d3252da2883ac8d942f3d3a43efdb0648e441224e7ff09a011ffab5ed54ca80
- SHA512
  
  1a43125758cdefc3cc815cdc768d9dc5e3f4ed373a0e24d16b18dfcb52f6e92224fa88ae33459f772d3e7d506bf9536f36897ebfcb9aeda0e4246c03f4d0f2d6
- SSDEEP
  
  6144:1SPV4MyG0KNuVDOomiWKYzz4jKW9YSTL4:I/UKNISPpTzz0jYUL4
Score

10^/10

sality backdoor evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorevasiontrojanupx

behavioral2

salitybackdoorupx