sality | ffef703973514ece4ce2b73bdaee270655b470554fcb5875c3b3858a66b4a56e | Triage

Sharing

General

Target

ffef703973514ece4ce2b73bdaee270655b470554fcb5875c3b3858a66b4a56e
Size

1.6MB
Sample

241205-smbmzszmax
MD5

5d90da9f571d8ed8b28b75430bfa975d
SHA1

3c53adbd7b27edb9b14a29da22a9ea66e67eee39
SHA256

ffef703973514ece4ce2b73bdaee270655b470554fcb5875c3b3858a66b4a56e
SHA512

932f72387a2d3b987e63a7bcfb3130ffc6ada47eb72d0dd0017e765fd67c6d7b6741c8751a69199a3116cdc3a28ff11dc7cd68719a2d396b4f92d72cece3ea8b
SSDEEP

24576:la1QsnVF9oandUSRQrAb4l47zV5k1km4ucOZoPcB7A1+Ll:+Vrood5lbA47gLRrK6A1+B

Score

10^/10

sality backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  ffef703973514ece4ce2b73bdaee270655b470554fcb5875c3b3858a66b4a56e
- Size
  
  1.6MB
- MD5
  
  5d90da9f571d8ed8b28b75430bfa975d
- SHA1
  
  3c53adbd7b27edb9b14a29da22a9ea66e67eee39
- SHA256
  
  ffef703973514ece4ce2b73bdaee270655b470554fcb5875c3b3858a66b4a56e
- SHA512
  
  932f72387a2d3b987e63a7bcfb3130ffc6ada47eb72d0dd0017e765fd67c6d7b6741c8751a69199a3116cdc3a28ff11dc7cd68719a2d396b4f92d72cece3ea8b
- SSDEEP
  
  24576:la1QsnVF9oandUSRQrAb4l47zV5k1km4ucOZoPcB7A1+Ll:+Vrood5lbA47gLRrK6A1+B
Score

10^/10

sality backdoor discovery upx evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoordiscoveryupx

behavioral2

salitybackdoordiscoveryevasiontrojanupx