sality | 82759044c51ec386238a044bbeb740ae3d748e7ac168578ad66af14281370bac | Triage

Sharing

General

Target

82759044c51ec386238a044bbeb740ae3d748e7ac168578ad66af14281370bac
Size

380KB
Sample

241204-ph86xazqdk
MD5

26fd35dbc2438e2173f5b250b5c643b3
SHA1

b975512202291b297210f38050c5f12535ebdd6e
SHA256

82759044c51ec386238a044bbeb740ae3d748e7ac168578ad66af14281370bac
SHA512

65293cf3693cea4760633af7a93bad018e00b73dfc1ffb56c1291f279dbfc3522cdda68ec06b06ae11f912a0f7cb398263a7098532f44515c157ce7990a1c49f
SSDEEP

6144:LIIIIAnObBs0l0yjkJR0ebjAOyqIBFlSb78Za/otdjlt1bUiYG:Xl0yA7joZG8Za/ov6iYG

Score

10^/10

sality backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  82759044c51ec386238a044bbeb740ae3d748e7ac168578ad66af14281370bac
- Size
  
  380KB
- MD5
  
  26fd35dbc2438e2173f5b250b5c643b3
- SHA1
  
  b975512202291b297210f38050c5f12535ebdd6e
- SHA256
  
  82759044c51ec386238a044bbeb740ae3d748e7ac168578ad66af14281370bac
- SHA512
  
  65293cf3693cea4760633af7a93bad018e00b73dfc1ffb56c1291f279dbfc3522cdda68ec06b06ae11f912a0f7cb398263a7098532f44515c157ce7990a1c49f
- SSDEEP
  
  6144:LIIIIAnObBs0l0yjkJR0ebjAOyqIBFlSb78Za/otdjlt1bUiYG:Xl0yA7joZG8Za/ov6iYG
Score

10^/10

sality backdoor discovery evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

salitybackdoordiscoveryevasiontrojanupx