sality | 6cee6cbd142902af0c735a0b3c9e8dcc48a9ec2d63923dbd493322c0a3586c74 | Triage

Sharing

General

Target

6cee6cbd142902af0c735a0b3c9e8dcc48a9ec2d63923dbd493322c0a3586c74
Size

3.2MB
Sample

230923-gcp7vaeh78
MD5

7ea6a6e307f4e878d0eee187e1409ed5
SHA1

7099ac36ce65b28b4648d799a6b69f739b8c9668
SHA256

6cee6cbd142902af0c735a0b3c9e8dcc48a9ec2d63923dbd493322c0a3586c74
SHA512

dd8449cf8f3e6754e1ff6a9a9d06a6a4104f6d56b99e48adf313482a111f479cb2f5129a842ed1e7e794eee3a9e4d96fc2eb31a809d6b535d29fefd8c03f3b35
SSDEEP

49152:4wPyfT5n+FjZCbBUZfAJKaDlSmUJlQ1PEqgYgf2T5dvagKXWZXKa8LFl:4wcTINCbBU1wMlQ1PEqg1c2

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  6cee6cbd142902af0c735a0b3c9e8dcc48a9ec2d63923dbd493322c0a3586c74
- Size
  
  3.2MB
- MD5
  
  7ea6a6e307f4e878d0eee187e1409ed5
- SHA1
  
  7099ac36ce65b28b4648d799a6b69f739b8c9668
- SHA256
  
  6cee6cbd142902af0c735a0b3c9e8dcc48a9ec2d63923dbd493322c0a3586c74
- SHA512
  
  dd8449cf8f3e6754e1ff6a9a9d06a6a4104f6d56b99e48adf313482a111f479cb2f5129a842ed1e7e794eee3a9e4d96fc2eb31a809d6b535d29fefd8c03f3b35
- SSDEEP
  
  49152:4wPyfT5n+FjZCbBUZfAJKaDlSmUJlQ1PEqgYgf2T5dvagKXWZXKa8LFl:4wcTINCbBU1wMlQ1PEqg1c2
Score

10^/10

sality backdoor evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorevasiontrojanupx

behavioral2

salitybackdoorupx