sality | fe373a45fe0372b7894e11867c67c76b7af011949420b3357ab452ea81f58b1b | Triage

Sharing

General

Target

ab23ba1c8b5e5366ffb66c4b6628da50
Size

160KB
Sample

240228-gdwe9acf33
MD5

ab23ba1c8b5e5366ffb66c4b6628da50
SHA1

64607060c493aa00e72b32bba0c83fda9733c63a
SHA256

fe373a45fe0372b7894e11867c67c76b7af011949420b3357ab452ea81f58b1b
SHA512

e55d4a75b7a0eb75e73bc44641a20256e1dc00b07adddc04a13f728c54a30467d9de85865ef6f93d7189a016a2b47a5c6386b092dff314e3dcde712c872d69e2
SSDEEP

3072:A6j7r6R7CISuILaJEag7sPNDO9vqaptNPyDRWIYwqjgsC8qj0n:5zISJLvBv7tcl6UY+m

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  ab23ba1c8b5e5366ffb66c4b6628da50
- Size
  
  160KB
- MD5
  
  ab23ba1c8b5e5366ffb66c4b6628da50
- SHA1
  
  64607060c493aa00e72b32bba0c83fda9733c63a
- SHA256
  
  fe373a45fe0372b7894e11867c67c76b7af011949420b3357ab452ea81f58b1b
- SHA512
  
  e55d4a75b7a0eb75e73bc44641a20256e1dc00b07adddc04a13f728c54a30467d9de85865ef6f93d7189a016a2b47a5c6386b092dff314e3dcde712c872d69e2
- SSDEEP
  
  3072:A6j7r6R7CISuILaJEag7sPNDO9vqaptNPyDRWIYwqjgsC8qj0n:5zISJLvBv7tcl6UY+m
Score

10^/10

sality backdoor upx evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorupx

behavioral2

salitybackdoorevasiontrojanupx