sality

General

Target

689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe
Size

2.0MB
Sample

240520-aggmyaac77
MD5

6036bd73dbef78a0bb21bace81ca703f
SHA1

59cb4799cafe00aba015c8a8eee53d3826e616d1
SHA256

689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9
SHA512

be5c11d73fd0c8edf0a1d89c79fd2847511efdc401fe057624c0de67a01d1047b2c76f636733d71c46557c4b6d855ec37694fccf368ee8057901662b4a38adfb
SSDEEP

49152:ZlqwRsD6EZq9NBN8EFWI6xuPFT4u6Dr1LJPMxi:ZlqwRsOEiTVFM2T4FDt

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9.exe
- Size
  
  2.0MB
- MD5
  
  6036bd73dbef78a0bb21bace81ca703f
- SHA1
  
  59cb4799cafe00aba015c8a8eee53d3826e616d1
- SHA256
  
  689b81de6ffbe96f2de1bee4652b9e55ad68f1572a339b4467b393e4bcaba1e9
- SHA512
  
  be5c11d73fd0c8edf0a1d89c79fd2847511efdc401fe057624c0de67a01d1047b2c76f636733d71c46557c4b6d855ec37694fccf368ee8057901662b4a38adfb
- SSDEEP
  
  49152:ZlqwRsD6EZq9NBN8EFWI6xuPFT4u6Dr1LJPMxi:ZlqwRsOEiTVFM2T4FDt
Score

10^/10

sality backdoor discovery evasion execution trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2