sality | 901b194af1ed08d34236d11dc5b00f6959aafbd35d657a0a65a00e9fda0a1c59 | Triage

Sharing

General

Target

901b194af1ed08d34236d11dc5b00f6959aafbd35d657a0a65a00e9fda0a1c59
Size

4.0MB
Sample

231126-dqkmqsef73
MD5

45eac9188cf9aae76bc14aa8ba4fbd0a
SHA1

a7bbe3292bd8bfc0b7b518214c570295b70525e6
SHA256

901b194af1ed08d34236d11dc5b00f6959aafbd35d657a0a65a00e9fda0a1c59
SHA512

20f2b9901fdc6b9b98c6a8ce5f8a0f20d479843377ba351f3db56360ad96b5c58fb7730db7d2d1e0cf72fa9d7976c0a4186c10dcf32ba7d3b5e37d791737d241
SSDEEP

49152:rAhAkT7I/8BgW9vnGoUnBLSnerYyKI70F+LfftrTtQ21kObQUrW4tAvNr5dw2Ii:LUeSvnGooBLSeaZF+DfttKUqoAFToi

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  901b194af1ed08d34236d11dc5b00f6959aafbd35d657a0a65a00e9fda0a1c59
- Size
  
  4.0MB
- MD5
  
  45eac9188cf9aae76bc14aa8ba4fbd0a
- SHA1
  
  a7bbe3292bd8bfc0b7b518214c570295b70525e6
- SHA256
  
  901b194af1ed08d34236d11dc5b00f6959aafbd35d657a0a65a00e9fda0a1c59
- SHA512
  
  20f2b9901fdc6b9b98c6a8ce5f8a0f20d479843377ba351f3db56360ad96b5c58fb7730db7d2d1e0cf72fa9d7976c0a4186c10dcf32ba7d3b5e37d791737d241
- SSDEEP
  
  49152:rAhAkT7I/8BgW9vnGoUnBLSnerYyKI70F+LfftrTtQ21kObQUrW4tAvNr5dw2Ii:LUeSvnGooBLSeaZF+DfttKUqoAFToi
Score

10^/10

sality backdoor upx evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorupx

behavioral2

salitybackdoorevasiontrojanupx