sality | 8ce94626e1c87b5ffd4443c3a30218e9be751de67aa36c3059885ab7b22c93a4 | Triage

Sharing

General

Target

49359f59e4941691a830ca441c3a2e2a.exe
Size

268KB
Sample

240107-xwajhadag5
MD5

49359f59e4941691a830ca441c3a2e2a
SHA1

ab279487771fad534d51cbf093728e19f7b2bb8b
SHA256

8ce94626e1c87b5ffd4443c3a30218e9be751de67aa36c3059885ab7b22c93a4
SHA512

22b03d2eb82068908919c1e062a63a234fc2e896d74e70a41dd43c7edafede631e08b482d9c8d7d5413a02666af9622a3e9af193b5c7bddb95e4f780a6defeda
SSDEEP

6144:6avaH8cS1kVZBr40ZhdOBL0vvIIhAOmkXkKAM:7RrqBr40raI1jUKAM

Score

10^/10

sality backdoor evasion persistence trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  49359f59e4941691a830ca441c3a2e2a.exe
- Size
  
  268KB
- MD5
  
  49359f59e4941691a830ca441c3a2e2a
- SHA1
  
  ab279487771fad534d51cbf093728e19f7b2bb8b
- SHA256
  
  8ce94626e1c87b5ffd4443c3a30218e9be751de67aa36c3059885ab7b22c93a4
- SHA512
  
  22b03d2eb82068908919c1e062a63a234fc2e896d74e70a41dd43c7edafede631e08b482d9c8d7d5413a02666af9622a3e9af193b5c7bddb95e4f780a6defeda
- SSDEEP
  
  6144:6avaH8cS1kVZBr40ZhdOBL0vvIIhAOmkXkKAM:7RrqBr40raI1jUKAM
Score

10^/10

sality backdoor evasion persistence trojan upx
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

salitybackdoorevasionpersistencetrojanupx