sality | 90dd7bd8fc736fbafcdb72b27c893725ce8f61c2b466fe6a93116f2df130dc3c | Triage

Sharing

General

Target

79729befc24b50558036dafebd7730b0_NeikiAnalytics.exe
Size

104KB
Sample

240526-gyey1aad46
MD5

79729befc24b50558036dafebd7730b0
SHA1

3cf6f5e7adab1f030cf4dc6de9c7281559c8e707
SHA256

90dd7bd8fc736fbafcdb72b27c893725ce8f61c2b466fe6a93116f2df130dc3c
SHA512

7905280b0030f0110b21092dd85a70498c480a7609945b19f1e311f0af6afbf0a67eb1a6286e244d19d98e39480f0a5d4e62b5320b871d9a4f2e3dd03fd34853
SSDEEP

3072:TSDADeak7dJHB/Aniql7Rh2Pm4Y/u/DXoROl:TSsQLH5AnX3h2u4Y/WDt

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  79729befc24b50558036dafebd7730b0_NeikiAnalytics.exe
- Size
  
  104KB
- MD5
  
  79729befc24b50558036dafebd7730b0
- SHA1
  
  3cf6f5e7adab1f030cf4dc6de9c7281559c8e707
- SHA256
  
  90dd7bd8fc736fbafcdb72b27c893725ce8f61c2b466fe6a93116f2df130dc3c
- SHA512
  
  7905280b0030f0110b21092dd85a70498c480a7609945b19f1e311f0af6afbf0a67eb1a6286e244d19d98e39480f0a5d4e62b5320b871d9a4f2e3dd03fd34853
- SSDEEP
  
  3072:TSDADeak7dJHB/Aniql7Rh2Pm4Y/u/DXoROl:TSsQLH5AnX3h2u4Y/WDt
Score

10^/10

sality backdoor upx evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorupx

behavioral2

salitybackdoorevasiontrojanupx