sality | 117b636591d1cef3b372b51694d72dc78b4cb37f998984d966541ead4cbe5172 | Triage

Sharing

General

Target

117b636591d1cef3b372b51694d72dc78b4cb37f998984d966541ead4cbe5172
Size

2.2MB
Sample

240519-rmg94abe71
MD5

017b6def2a637a5f4d26b85bfa2a903b
SHA1

83b3b2e971a5f30163bd5e4f9d4b827021cbe291
SHA256

117b636591d1cef3b372b51694d72dc78b4cb37f998984d966541ead4cbe5172
SHA512

3eabc553fdb1bef1551581f7e323f8c157d1e1387c50f04306d34294f0fff790de7bd1954368091ff3a56d34f488d41b6993d7b1e557b44f1960b71372e6ad65
SSDEEP

49152:wdggggMlwsDgo3aKfft5OtH17CZZK2KP/hk4wEvea+jWJ:vwY+KXnCH17CXgh/J

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  117b636591d1cef3b372b51694d72dc78b4cb37f998984d966541ead4cbe5172
- Size
  
  2.2MB
- MD5
  
  017b6def2a637a5f4d26b85bfa2a903b
- SHA1
  
  83b3b2e971a5f30163bd5e4f9d4b827021cbe291
- SHA256
  
  117b636591d1cef3b372b51694d72dc78b4cb37f998984d966541ead4cbe5172
- SHA512
  
  3eabc553fdb1bef1551581f7e323f8c157d1e1387c50f04306d34294f0fff790de7bd1954368091ff3a56d34f488d41b6993d7b1e557b44f1960b71372e6ad65
- SSDEEP
  
  49152:wdggggMlwsDgo3aKfft5OtH17CZZK2KP/hk4wEvea+jWJ:vwY+KXnCH17CXgh/J
Score

10^/10

sality backdoor upx evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Modify Registry

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

salitybackdoorupx

behavioral2

salitybackdoorevasiontrojanupx