sality | 3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e | Triage

Sharing

General

Target

3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin
Size

2.0MB
Sample

240517-zw1f2abb33
MD5

98c17b152d7bfb9c5a024b6ed479ecc5
SHA1

a563303925f1bfaa8ec08e7d233440ff84a8e3f5
SHA256

3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e
SHA512

0202b354c43291b67ddcb9acb683e422650962d2addb264cfdc10c4cb85d36a6e4286660062083f6fcd46216cfd67ee55474d8a5d4317f67ac37f9d1dae267d9
SSDEEP

49152:3uriX899OM/gSY8wHTsb+92hnHO6xfV6vq7NrpOPfgLs1OADgMex:3uriq9jgSY3Two2hHXxL7NrpjD

Score

10^/10

sality backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin
- Size
  
  2.0MB
- MD5
  
  98c17b152d7bfb9c5a024b6ed479ecc5
- SHA1
  
  a563303925f1bfaa8ec08e7d233440ff84a8e3f5
- SHA256
  
  3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e
- SHA512
  
  0202b354c43291b67ddcb9acb683e422650962d2addb264cfdc10c4cb85d36a6e4286660062083f6fcd46216cfd67ee55474d8a5d4317f67ac37f9d1dae267d9
- SSDEEP
  
  49152:3uriX899OM/gSY8wHTsb+92hnHO6xfV6vq7NrpOPfgLs1OADgMex:3uriq9jgSY3Two2hHXxL7NrpjD
Score

10^/10

sality backdoor discovery upx evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoordiscoveryupx

behavioral2

salitybackdoordiscoveryevasiontrojanupx