sality | 41a3663c26d5f147d16a2c12f3155d49e2d12b384e5c6bc39ca09b9f9c37f759 | Triage

Sharing

General

Target

015a4500757a41e223c70f19a3c9291a_JaffaCakes118
Size

113KB
Sample

240620-af42vayaqb
MD5

015a4500757a41e223c70f19a3c9291a
SHA1

d9f56431ba034fa5f48d942eede6689d5e0d9c5d
SHA256

41a3663c26d5f147d16a2c12f3155d49e2d12b384e5c6bc39ca09b9f9c37f759
SHA512

43757c2c807269a335bdac5e8314a29ad2c8f51eabd81169036b820784946dca7638e7258b80bdf68065028f70cd5f0c208fcc47cd0e6c7e793b6eb2e2fe4571
SSDEEP

3072:VSaKQJB/7UcatkTSVME2EzYjMPedHehOA:VqDkT4RkjMrR

Score

10^/10

sality backdoor evasion persistence privilege_escalation trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  015a4500757a41e223c70f19a3c9291a_JaffaCakes118
- Size
  
  113KB
- MD5
  
  015a4500757a41e223c70f19a3c9291a
- SHA1
  
  d9f56431ba034fa5f48d942eede6689d5e0d9c5d
- SHA256
  
  41a3663c26d5f147d16a2c12f3155d49e2d12b384e5c6bc39ca09b9f9c37f759
- SHA512
  
  43757c2c807269a335bdac5e8314a29ad2c8f51eabd81169036b820784946dca7638e7258b80bdf68065028f70cd5f0c208fcc47cd0e6c7e793b6eb2e2fe4571
- SSDEEP
  
  3072:VSaKQJB/7UcatkTSVME2EzYjMPedHehOA:VqDkT4RkjMrR
Score

10^/10

sality backdoor evasion persistence privilege_escalation trojan upx
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

salitybackdoorevasionpersistenceprivilege_escalationtrojanupx