sality | 1751d237603d0f7f861af5f017aae2481db1cb2894369808eea83b4397c051ea | Triage

Sharing

General

Target

1751d237603d0f7f861af5f017aae2481db1cb2894369808eea83b4397c051ea_NeikiAnalytics.exe
Size

284KB
Sample

240619-3ef8ls1dnq
MD5

3972895a6dbf0fdadf1c1dd142cdc0a0
SHA1

410e5bea0c64264a8f82d8428b0e26de53f22d3b
SHA256

1751d237603d0f7f861af5f017aae2481db1cb2894369808eea83b4397c051ea
SHA512

ea4e3e94ceb801710a79aafa1f086aad0768c7965cf2c6f0656a284fd3873ef88749f9e0ef904440b38f5c33693a25f224a8e53e2bf9664dc67e34fd4fc56cf2
SSDEEP

6144:QgjTffsAeph79dcGd3dR7Fuy7LILqkbJkQlout+1z/5H4NMbr:QgjLUAeph79dcK3dR7i4uTtAD5HQMbr

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  1751d237603d0f7f861af5f017aae2481db1cb2894369808eea83b4397c051ea_NeikiAnalytics.exe
- Size
  
  284KB
- MD5
  
  3972895a6dbf0fdadf1c1dd142cdc0a0
- SHA1
  
  410e5bea0c64264a8f82d8428b0e26de53f22d3b
- SHA256
  
  1751d237603d0f7f861af5f017aae2481db1cb2894369808eea83b4397c051ea
- SHA512
  
  ea4e3e94ceb801710a79aafa1f086aad0768c7965cf2c6f0656a284fd3873ef88749f9e0ef904440b38f5c33693a25f224a8e53e2bf9664dc67e34fd4fc56cf2
- SSDEEP
  
  6144:QgjTffsAeph79dcGd3dR7Fuy7LILqkbJkQlout+1z/5H4NMbr:QgjLUAeph79dcK3dR7i4uTtAD5HQMbr
Score

10^/10

sality backdoor evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Modify Registry

Impair Defenses

Disable or Modify Tools

Disable or Modify System Firewall

Abuse Elevation Control Mechanism

Bypass User Account Control

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

salitybackdoorevasiontrojanupx