sality | 44f7fcbb23a534ddbe15362f240a2a4c97482a322c0bb738f00e0db2ae7ece17 | Triage

Sharing

General

Target

44f7fcbb23a534ddbe15362f240a2a4c97482a322c0bb738f00e0db2ae7ece17
Size

2.3MB
Sample

240418-kclq7shc8y
MD5

1e69bd9cbcafe69895d78cba2c3fb6ce
SHA1

ffc75555311caddc93c1704dbe7703c8eac78598
SHA256

44f7fcbb23a534ddbe15362f240a2a4c97482a322c0bb738f00e0db2ae7ece17
SHA512

ba60ae2b82fe5ec90e08911f38be502e1bed682eace2393d023cf463177d8c4ffb8def35af32c2a17d96bc3f7257717b910dca8adddfa41da0ef14d9e14f8b42
SSDEEP

49152:YvggggMWMb0aDsQ1FTw5GbFp0whdZSjYKP/hVY7kXE7o:Y+b0aDfssbFpbUYghL

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  44f7fcbb23a534ddbe15362f240a2a4c97482a322c0bb738f00e0db2ae7ece17
- Size
  
  2.3MB
- MD5
  
  1e69bd9cbcafe69895d78cba2c3fb6ce
- SHA1
  
  ffc75555311caddc93c1704dbe7703c8eac78598
- SHA256
  
  44f7fcbb23a534ddbe15362f240a2a4c97482a322c0bb738f00e0db2ae7ece17
- SHA512
  
  ba60ae2b82fe5ec90e08911f38be502e1bed682eace2393d023cf463177d8c4ffb8def35af32c2a17d96bc3f7257717b910dca8adddfa41da0ef14d9e14f8b42
- SSDEEP
  
  49152:YvggggMWMb0aDsQ1FTw5GbFp0whdZSjYKP/hVY7kXE7o:Y+b0aDfssbFpbUYghL
Score

10^/10

sality backdoor evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorevasiontrojanupx

behavioral2

salitybackdoorevasiontrojanupx