sality | 3f14a574ece202cbec07af27e527a4661421ffc53c5c05b2987d3c5cb1dbe168 | Triage

Sharing

General

Target

fc0327b5b7ede6d76fa2a2563747b0d8_JaffaCakes118
Size

69KB
Sample

240420-fzcdtsab9x
MD5

fc0327b5b7ede6d76fa2a2563747b0d8
SHA1

d8671aec34a40eb68f8f0a6df42e8129dc31a032
SHA256

3f14a574ece202cbec07af27e527a4661421ffc53c5c05b2987d3c5cb1dbe168
SHA512

c721ed3d30a090a28da3307561f8c6d42a01a7639e969b1f3739b585b3256724a6c6046d94b382e66c998760335c501e4fc66f4d2951c2a1f54672f86553da20
SSDEEP

1536:3wiAlmRg9myI9b7WloSa9UGXHvlgPAkHbKQwj5G3S4badq/LD:3wiAlmomycuo0VdYj5FLdUD

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  fc0327b5b7ede6d76fa2a2563747b0d8_JaffaCakes118
- Size
  
  69KB
- MD5
  
  fc0327b5b7ede6d76fa2a2563747b0d8
- SHA1
  
  d8671aec34a40eb68f8f0a6df42e8129dc31a032
- SHA256
  
  3f14a574ece202cbec07af27e527a4661421ffc53c5c05b2987d3c5cb1dbe168
- SHA512
  
  c721ed3d30a090a28da3307561f8c6d42a01a7639e969b1f3739b585b3256724a6c6046d94b382e66c998760335c501e4fc66f4d2951c2a1f54672f86553da20
- SSDEEP
  
  1536:3wiAlmRg9myI9b7WloSa9UGXHvlgPAkHbKQwj5G3S4badq/LD:3wiAlmomycuo0VdYj5FLdUD
Score

10^/10

sality backdoor upx evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorupx

behavioral2

salitybackdoorevasiontrojanupx