sality

Sharing

Copy URL Twitter E-mail

General

Target
a81adbf226541ece20dfd6b8cd47a2f5
Size 172KB
Sample240227-d176saff3v
SHA256 41d7253ab0d4f1ff8b3a76d420212dd98fa58421c5ec9dd54f8615d6316c0ac0
MD5 a81adbf226541ece20dfd6b8cd47a2f5
SHA1 4ee0d36808c57aaf2e28607e4dcd7ad9bfb7e76f
SHA512 60c540b6708639eb6b7d9a4ec814f7eb99c15c59afe160ad65e9e2e606cb05d95a19a0631cc07f53b94d9197ba8696a6accfc40e6dbefba93f6b7988a8f5ac6d
SSDEEP 3072:4gXdZC9P6D3XJnceAdc2Dkd71l40XAyYigO/3xPfQfgBaQ1sOMsm4VOw:4ew4xmdnIhn40wogO/mIBtsfGVOw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif

Targets

- Target
  a81adbf226541ece20dfd6b8cd47a2f5
- Size 172KB
- SHA256 41d7253ab0d4f1ff8b3a76d420212dd98fa58421c5ec9dd54f8615d6316c0ac0
- MD5 a81adbf226541ece20dfd6b8cd47a2f5
- SHA1 4ee0d36808c57aaf2e28607e4dcd7ad9bfb7e76f
- SHA512 60c540b6708639eb6b7d9a4ec814f7eb99c15c59afe160ad65e9e2e606cb05d95a19a0631cc07f53b94d9197ba8696a6accfc40e6dbefba93f6b7988a8f5ac6d
- SSDEEP 3072:4gXdZC9P6D3XJnceAdc2Dkd71l40XAyYigO/3xPfQfgBaQ1sOMsm4VOw:4ew4xmdnIhn40wogO/mIBtsfGVOw
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

sality backdoor evasion spyware stealer trojan upx
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2
- Target
  $PLUGINSDIR/Processes.dll
- Size 56KB
- SHA256 3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
- MD5 cc0bd4f5a79107633084471dbd4af796
- SHA1 09dfcf182b1493161dec8044a5234c35ee24c43a
- SHA512 67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3
- SSDEEP 768:WmswCIbuzwEmd7Fp4KpDAKngV9tV3rJy63JgaVwoz7si4uYqUYWu1gYwmj552RFB:WmswCIbuzwEy7n3YD3Jgw7shKrp55io
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- MD5 7579ade7ae1747a31960a228ce02e666
- SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
- MD5 SHA1 SHA512
Score

3^/10
behavioral7 behavioral8