sality | d10b5b22f1e039fbc518cdeec2b010bcda40ed18627260e46d7a7f7775bb9245 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1606a462667c11bee366f63a9f3fecad_JaffaCakes118
Size

189KB
Sample

241005-d9rkdsxgjb
MD5

1606a462667c11bee366f63a9f3fecad
SHA1

2017b1831363429caaefeb56412ee9e11cd5bbb0
SHA256

d10b5b22f1e039fbc518cdeec2b010bcda40ed18627260e46d7a7f7775bb9245
SHA512

ccddf26f1cfb159a11d70db0e41e24ac9a8a270c64fe61a23548235bed6bd4ddf13cc378d2f8369b031f603511644e5005ea650d6d9baab6961519bc0028652c
SSDEEP

3072:DNgEtYM9J9GnlRbGr2B0o5xY9tuLu+iO4Fg0mQhQxN6eKVZglsr9UgP3A:ltl9JGGxowezid+cQxDlkGgvA

Score

10^/10

sality backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  1606a462667c11bee366f63a9f3fecad_JaffaCakes118
- Size
  
  189KB
- MD5
  
  1606a462667c11bee366f63a9f3fecad
- SHA1
  
  2017b1831363429caaefeb56412ee9e11cd5bbb0
- SHA256
  
  d10b5b22f1e039fbc518cdeec2b010bcda40ed18627260e46d7a7f7775bb9245
- SHA512
  
  ccddf26f1cfb159a11d70db0e41e24ac9a8a270c64fe61a23548235bed6bd4ddf13cc378d2f8369b031f603511644e5005ea650d6d9baab6961519bc0028652c
- SSDEEP
  
  3072:DNgEtYM9J9GnlRbGr2B0o5xY9tuLu+iO4Fg0mQhQxN6eKVZglsr9UgP3A:ltl9JGGxowezid+cQxDlkGgvA
Score

10^/10

sality backdoor discovery upx evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoordiscoveryupx

behavioral2

salitybackdoordiscoveryevasiontrojanupx