sality | 499bfb6ea0dd2033ee1571ca8486628e031af27c127b0ec62bedef8ba7a5830b | Triage

Sharing

General

Target

499bfb6ea0dd2033ee1571ca8486628e031af27c127b0ec62bedef8ba7a5830b
Size

101KB
Sample

221123-xkap5afc33
MD5

43ee6f0a6d6ea01206a8bff98cf7a580
SHA1

d7b9f675a2d4ef34eacd76276d2c64056209d07e
SHA256

499bfb6ea0dd2033ee1571ca8486628e031af27c127b0ec62bedef8ba7a5830b
SHA512

438a4fefe8dbbd2475d16c68014096f457f6f07f893d68ca13455a4ceee22e73107c398d8950066de18f299eb8090533fbdea7a02eee404830e84ba1c636640b
SSDEEP

3072:eKyyAOxmoh0U2ZS+PhYF+vmZnO+Xuu0KQHsVAzl:O5OxV0U2A0hYF+IOIz0dHsVg

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  499bfb6ea0dd2033ee1571ca8486628e031af27c127b0ec62bedef8ba7a5830b
- Size
  
  101KB
- MD5
  
  43ee6f0a6d6ea01206a8bff98cf7a580
- SHA1
  
  d7b9f675a2d4ef34eacd76276d2c64056209d07e
- SHA256
  
  499bfb6ea0dd2033ee1571ca8486628e031af27c127b0ec62bedef8ba7a5830b
- SHA512
  
  438a4fefe8dbbd2475d16c68014096f457f6f07f893d68ca13455a4ceee22e73107c398d8950066de18f299eb8090533fbdea7a02eee404830e84ba1c636640b
- SSDEEP
  
  3072:eKyyAOxmoh0U2ZS+PhYF+vmZnO+Xuu0KQHsVAzl:O5OxV0U2A0hYF+IOIz0dHsVg
Score

10^/10

sality backdoor evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Modify Registry

Bypass User Account Control

Disabling Security Tools

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

salitybackdoorevasiontrojanupx

behavioral2

salitybackdoorupx