sality

General

Target

46493b50f0fe2e9acaecceda4be9124f
Size

314KB
Sample

231226-aq7wgsdebj
MD5

46493b50f0fe2e9acaecceda4be9124f
SHA1

87d36884fba1befe5f33b45e2750f00a6e400ba4
SHA256

9ab29f4e939396b94de9df9bf13fa8bec718457bcbc5ababdf69eac48db88a40
SHA512

5742b268c1f0e23efcd959a6e7a9af86418e2ec953890bf5bc48cfb188839b903ba1658b9a8681b6a0a0cd4b710493da862d3b359e1bd1146174a643d74e446b
SSDEEP

6144:txA/BD/qHWdl5EFJSsOkuNg051iH6wNTGN9pzuvJgr:txA/Vj5EFElhV5+hBK3zuvir

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  46493b50f0fe2e9acaecceda4be9124f
- Size
  
  314KB
- MD5
  
  46493b50f0fe2e9acaecceda4be9124f
- SHA1
  
  87d36884fba1befe5f33b45e2750f00a6e400ba4
- SHA256
  
  9ab29f4e939396b94de9df9bf13fa8bec718457bcbc5ababdf69eac48db88a40
- SHA512
  
  5742b268c1f0e23efcd959a6e7a9af86418e2ec953890bf5bc48cfb188839b903ba1658b9a8681b6a0a0cd4b710493da862d3b359e1bd1146174a643d74e446b
- SSDEEP
  
  6144:txA/BD/qHWdl5EFJSsOkuNg051iH6wNTGN9pzuvJgr:txA/Vj5EFElhV5+hBK3zuvir
Score

10^/10

sality backdoor evasion trojan upx
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Windows security bypass

Disables RegEdit via registry modification

Disables Task Manager via registry modification

UPX packed file

Windows security modification

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2