sality | 1ed3766d83aaf74d7b453c28a4ed48ac3ae083120c6c76d294f59e7b995e634e | Triage

Sharing

General

Target

e33d87abe6e88cb32af5d7981b533b90_NeikiAnalytics
Size

88KB
Sample

240516-swfcjaba5x
MD5

e33d87abe6e88cb32af5d7981b533b90
SHA1

7b784dfede011448ead228c593507264a550722e
SHA256

1ed3766d83aaf74d7b453c28a4ed48ac3ae083120c6c76d294f59e7b995e634e
SHA512

f8bb9edf7f31c6a33d637b669236b2e342ccec7f157c954c5abc08777da0d64017758d38a5701c6cacaa82261d8b01cd1d72c9eb2d8263f919567222f53c07e7
SSDEEP

1536:JTkdAzUYFhyBvnZwtIEWizIr2FfGcCjGuFv1lQJKyN065KiyhQ5:JI8UYFonZwtIgFfGcOLQJKGKiy+5

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  e33d87abe6e88cb32af5d7981b533b90_NeikiAnalytics
- Size
  
  88KB
- MD5
  
  e33d87abe6e88cb32af5d7981b533b90
- SHA1
  
  7b784dfede011448ead228c593507264a550722e
- SHA256
  
  1ed3766d83aaf74d7b453c28a4ed48ac3ae083120c6c76d294f59e7b995e634e
- SHA512
  
  f8bb9edf7f31c6a33d637b669236b2e342ccec7f157c954c5abc08777da0d64017758d38a5701c6cacaa82261d8b01cd1d72c9eb2d8263f919567222f53c07e7
- SSDEEP
  
  1536:JTkdAzUYFhyBvnZwtIEWizIr2FfGcCjGuFv1lQJKyN065KiyhQ5:JI8UYFonZwtIgFfGcOLQJKGKiy+5
Score

10^/10

sality backdoor evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorevasiontrojanupx

behavioral2