sality

General

Target

2024-06-08_eda184c30ee1843affa70017faf4c81d_icedid
Size

2.1MB
Sample

240608-f56vmahd7y
MD5

eda184c30ee1843affa70017faf4c81d
SHA1

86488f71dc0aefbd3d48be1bf7ac594dfbe3f10d
SHA256

a74df8c356b6e3ef4da13569c6f9378a974254e268dafb94d8ffab8d5c5b1552
SHA512

2c97e6fa407a2a7374e960782cec02015fb0e58941fe4eca96fc57f4a2209476d435f843ceaa113e89dc88e66fbb45084af1bb8c501c5887393364284ee64a78
SSDEEP

49152:j61ZXdk7ifSTq+ZAcoAqzV0E22tinShvn:j61Ztk7iKTq5coAqPin8

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  2024-06-08_eda184c30ee1843affa70017faf4c81d_icedid
- Size
  
  2.1MB
- MD5
  
  eda184c30ee1843affa70017faf4c81d
- SHA1
  
  86488f71dc0aefbd3d48be1bf7ac594dfbe3f10d
- SHA256
  
  a74df8c356b6e3ef4da13569c6f9378a974254e268dafb94d8ffab8d5c5b1552
- SHA512
  
  2c97e6fa407a2a7374e960782cec02015fb0e58941fe4eca96fc57f4a2209476d435f843ceaa113e89dc88e66fbb45084af1bb8c501c5887393364284ee64a78
- SSDEEP
  
  49152:j61ZXdk7ifSTq+ZAcoAqzV0E22tinShvn:j61Ztk7iKTq5coAqPin8
Score

10^/10

sality backdoor bootkit evasion persistence trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
- UPX dump on OEP (original entry point)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2