sality | 472b9ae70417addfa36684f9b3970d11ec745428c87d8245269e1f4b18d56475 | Triage

Sharing

General

Target

472b9ae70417addfa36684f9b3970d11ec745428c87d8245269e1f4b18d56475
Size

745KB
Sample

231114-3pqvssgf79
MD5

ea6e3b4603162ac27dc4e6a5692e1eb4
SHA1

a43d07f75343a7db48291a39c03c680236973fae
SHA256

472b9ae70417addfa36684f9b3970d11ec745428c87d8245269e1f4b18d56475
SHA512

e4b557e9df48ad48e576381f355fbf01dfed0ba9fe2fcd1fffa5166dfbf5683ccd00e0cd3b80cd6856b3ed1002b06e43582f093e124389dded8d461f54962a00
SSDEEP

12288:BR/EXGkkK4M56qdiZnZZKwFvkesFLliJfKDhW7+iFnUzqn6m5TsK1MGsmyarxh9b:7/EXlytZgwFsesFxYSDOFnUz+6m5Tn1N

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  472b9ae70417addfa36684f9b3970d11ec745428c87d8245269e1f4b18d56475
- Size
  
  745KB
- MD5
  
  ea6e3b4603162ac27dc4e6a5692e1eb4
- SHA1
  
  a43d07f75343a7db48291a39c03c680236973fae
- SHA256
  
  472b9ae70417addfa36684f9b3970d11ec745428c87d8245269e1f4b18d56475
- SHA512
  
  e4b557e9df48ad48e576381f355fbf01dfed0ba9fe2fcd1fffa5166dfbf5683ccd00e0cd3b80cd6856b3ed1002b06e43582f093e124389dded8d461f54962a00
- SSDEEP
  
  12288:BR/EXGkkK4M56qdiZnZZKwFvkesFLliJfKDhW7+iFnUzqn6m5TsK1MGsmyarxh9b:7/EXlytZgwFsesFxYSDOFnUz+6m5Tn1N
Score

10^/10

sality backdoor upx evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorupx

behavioral2

salitybackdoorevasiontrojanupx