sality | 5a7c45218b50cee54d32131695d55f385af24c37d0b9a788de9ea6c465005293 | Triage

Sharing

General

Target

5a7c45218b50cee54d32131695d55f385af24c37d0b9a788de9ea6c465005293
Size

128KB
Sample

240517-me5yzade6y
MD5

21e9a4adbf70b295fb6b81f7998e9c39
SHA1

2f6b14983570185fa111ca30a2848a7cae32792e
SHA256

5a7c45218b50cee54d32131695d55f385af24c37d0b9a788de9ea6c465005293
SHA512

ab67f371ae40645de366052359b94fd28feefdda6afcfb794407f0460905a68375af5eeb1e9c7453509450d68b165c7a46af76b893bf611fb5243a5dfa65ff91
SSDEEP

3072:uftffjmNmcoa3b9OBFhfY6XHNNTGkZm1MOTLjAimC:WVfjmNm+BOBbfY6XHjSkZmGgjAiF

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  5a7c45218b50cee54d32131695d55f385af24c37d0b9a788de9ea6c465005293
- Size
  
  128KB
- MD5
  
  21e9a4adbf70b295fb6b81f7998e9c39
- SHA1
  
  2f6b14983570185fa111ca30a2848a7cae32792e
- SHA256
  
  5a7c45218b50cee54d32131695d55f385af24c37d0b9a788de9ea6c465005293
- SHA512
  
  ab67f371ae40645de366052359b94fd28feefdda6afcfb794407f0460905a68375af5eeb1e9c7453509450d68b165c7a46af76b893bf611fb5243a5dfa65ff91
- SSDEEP
  
  3072:uftffjmNmcoa3b9OBFhfY6XHNNTGkZm1MOTLjAimC:WVfjmNm+BOBbfY6XHjSkZmGgjAiF
Score

10^/10

upx sality backdoor evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

salitybackdoorevasiontrojanupx