sality | 8b1ed7712af16f50868ca16c409cbb18733b8b97be14e53f20fabe0d1c802311 | Triage

Sharing

General

Target

8b1ed7712af16f50868ca16c409cbb18733b8b97be14e53f20fabe0d1c802311
Size

976KB
Sample

241206-xzhz2ssnfv
MD5

3a2e885db234ac4de2c227fc6bc3a228
SHA1

e86ac74e6b7d80438430a95fcb3ddb8e64466060
SHA256

8b1ed7712af16f50868ca16c409cbb18733b8b97be14e53f20fabe0d1c802311
SHA512

6b7b0d226a481db0a73bd308a9c5c998ef11900f6c947b90c1fc3183e4e9d40ad18fdcd54ecf02d88f3c7c4d6af59d3b75e2fc9d041d1ea274a751a3ec22f0b0
SSDEEP

12288:Pg3oAHViDNkd+dqqWOmUcfKXiLRuTekmXSbVyVD49qWJkBUsZDZFRPMAJVlia4Ji:tAHoBkd+dqROLceTerD0qHDZvPMSi1s

Score

10^/10

sality backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  8b1ed7712af16f50868ca16c409cbb18733b8b97be14e53f20fabe0d1c802311
- Size
  
  976KB
- MD5
  
  3a2e885db234ac4de2c227fc6bc3a228
- SHA1
  
  e86ac74e6b7d80438430a95fcb3ddb8e64466060
- SHA256
  
  8b1ed7712af16f50868ca16c409cbb18733b8b97be14e53f20fabe0d1c802311
- SHA512
  
  6b7b0d226a481db0a73bd308a9c5c998ef11900f6c947b90c1fc3183e4e9d40ad18fdcd54ecf02d88f3c7c4d6af59d3b75e2fc9d041d1ea274a751a3ec22f0b0
- SSDEEP
  
  12288:Pg3oAHViDNkd+dqqWOmUcfKXiLRuTekmXSbVyVD49qWJkBUsZDZFRPMAJVlia4Ji:tAHoBkd+dqROLceTerD0qHDZvPMSi1s
Score

10^/10

discovery sality backdoor evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

salitybackdoordiscoveryevasiontrojanupx