sality | 4e588fc1c336e8c453c3a29b30eccf76fd2122f299b643c4197d67f2896dc17c | Triage

Submit
Reports

Overview

overview

Static

static

3

4e588fc1c3...7c.exe

windows7-x64

4e588fc1c3...7c.exe

windows10-2004-x64

3

Sharing

General

Target

4e588fc1c336e8c453c3a29b30eccf76fd2122f299b643c4197d67f2896dc17c.exe
Size

120KB
Sample

241205-mt8y6s1lax
MD5

dc3bbfc6e9091a53a317227febc1e4d7
SHA1

080aac5ec1de2bdfb46be09d665d11ef188ad540
SHA256

4e588fc1c336e8c453c3a29b30eccf76fd2122f299b643c4197d67f2896dc17c
SHA512

36e0cbe1744bbbebfdceb73c1ccc17729de4652abf9ff18b75664f2462eabe96b4377059d7e366a396d679512d803c5b44d5f5fceb6ff03b4d72481e15f97ecd
SSDEEP

3072:m9tSR5/g/J/h5uVm9Zi68W/4vphU83q64EX26jMt7Egylk:mWR5/g/J/vzr8WQ/U83JH2UMEgJ

Score

10^/10

sality backdoor discovery evasion trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4e588fc1c336e8c453c3a29b30eccf76fd2122f299b643c4197d67f2896dc17c.exe

Resource

win7-20241010-en

sality backdoor discovery evasion trojan upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

4e588fc1c336e8c453c3a29b30eccf76fd2122f299b643c4197d67f2896dc17c.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  4e588fc1c336e8c453c3a29b30eccf76fd2122f299b643c4197d67f2896dc17c.exe
- Size
  
  120KB
- MD5
  
  dc3bbfc6e9091a53a317227febc1e4d7
- SHA1
  
  080aac5ec1de2bdfb46be09d665d11ef188ad540
- SHA256
  
  4e588fc1c336e8c453c3a29b30eccf76fd2122f299b643c4197d67f2896dc17c
- SHA512
  
  36e0cbe1744bbbebfdceb73c1ccc17729de4652abf9ff18b75664f2462eabe96b4377059d7e366a396d679512d803c5b44d5f5fceb6ff03b4d72481e15f97ecd
- SSDEEP
  
  3072:m9tSR5/g/J/h5uVm9Zi68W/4vphU83q64EX26jMt7Egylk:mWR5/g/J/vzr8WQ/U83JH2UMEgJ
Score

10^/10

sality backdoor discovery evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoordiscoveryevasiontrojanupx

behavioral2

© 2018-2025

Terms | Privacy