sality

General

Target

028d557d471a67be510421061dc376a5b2f9c3d0015ee9ba1d96e27e72839a34
Size

1.1MB
Sample

240529-ssbj6sbb45
MD5

dcd15634bb9c065a4b55e9798f10a17a
SHA1

979fb09e75ca827aa4cf1f773bbbd8963b1ffbb9
SHA256

028d557d471a67be510421061dc376a5b2f9c3d0015ee9ba1d96e27e72839a34
SHA512

f16597c050985c470abbccf27dc3cd135889e3764d9a5938f4d5ec998c232065d93c3aead3c067eee4a8d4f7a4f9e3a3472c5c0323b2efa09ad3f0da4142b05c
SSDEEP

24576:ZJqtZ2F83eGiHKCsLnMpK5SFdtNc/enhABFlEpdJo7:ZJq62hCsDaHdtNcDEpdJo7

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  028d557d471a67be510421061dc376a5b2f9c3d0015ee9ba1d96e27e72839a34
- Size
  
  1.1MB
- MD5
  
  dcd15634bb9c065a4b55e9798f10a17a
- SHA1
  
  979fb09e75ca827aa4cf1f773bbbd8963b1ffbb9
- SHA256
  
  028d557d471a67be510421061dc376a5b2f9c3d0015ee9ba1d96e27e72839a34
- SHA512
  
  f16597c050985c470abbccf27dc3cd135889e3764d9a5938f4d5ec998c232065d93c3aead3c067eee4a8d4f7a4f9e3a3472c5c0323b2efa09ad3f0da4142b05c
- SSDEEP
  
  24576:ZJqtZ2F83eGiHKCsLnMpK5SFdtNc/enhABFlEpdJo7:ZJq62hCsDaHdtNcDEpdJo7
Score

10^/10

sality backdoor bootkit discovery evasion persistence trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2