sality

General

Target

ddd6f076f47250dc916664d8fa29e8ac4cf464a70de309e1305987c2fbfa7577
Size

316KB
Sample

240527-d44mrsfg47
MD5

c7248067bc8c5a1f5c33c3d55cb12ac9
SHA1

6e2961c103372907db29a9b3e1cc939a54084ca1
SHA256

ddd6f076f47250dc916664d8fa29e8ac4cf464a70de309e1305987c2fbfa7577
SHA512

691618e24ffc93fdceae880be28a771d6683708619255a298eccfc63e080db088bb722a72af525d274c685fefb5a53146dd448f7231b229786fa1c7e44580d0a
SSDEEP

3072:aOXQxG+IpQZQneFAMx3qe8UzT+nWwXjDRJWwXjDRgjDRbL7SCqO69Z7gnWYU7Wh:l4GlpQEQAMtqNUzC7OSeDh

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  ddd6f076f47250dc916664d8fa29e8ac4cf464a70de309e1305987c2fbfa7577
- Size
  
  316KB
- MD5
  
  c7248067bc8c5a1f5c33c3d55cb12ac9
- SHA1
  
  6e2961c103372907db29a9b3e1cc939a54084ca1
- SHA256
  
  ddd6f076f47250dc916664d8fa29e8ac4cf464a70de309e1305987c2fbfa7577
- SHA512
  
  691618e24ffc93fdceae880be28a771d6683708619255a298eccfc63e080db088bb722a72af525d274c685fefb5a53146dd448f7231b229786fa1c7e44580d0a
- SSDEEP
  
  3072:aOXQxG+IpQZQneFAMx3qe8UzT+nWwXjDRJWwXjDRgjDRbL7SCqO69Z7gnWYU7Wh:l4GlpQEQAMtqNUzC7OSeDh
Score

10^/10

sality backdoor evasion persistence spyware stealer trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2