sality | e20565cf2241006ccc5dfa8ed10107e7d6a4dc68db2b08a9c6b5a64ac9b1d4f3 | Triage

Sharing

General

Target

e20565cf2241006ccc5dfa8ed10107e7d6a4dc68db2b08a9c6b5a64ac9b1d4f3
Size

1021KB
Sample

241206-y775kssjdl
MD5

8cf987649a7e85a7e32023b57d70ce82
SHA1

add3505177fa3c67146d0d56695a7508a9a539e1
SHA256

e20565cf2241006ccc5dfa8ed10107e7d6a4dc68db2b08a9c6b5a64ac9b1d4f3
SHA512

5dc1e94f0352f2655c8832b4edad8451964a8553c1f383706df8997a1fe6b5dbb341cd365949ac86e60b6339e51004a5de7cd5e77d178b6997b18d6d275bf1ab
SSDEEP

12288:jsrHw1yQlMQwPopJ3Pn+roNkb/QZK1LgdBER4GzbhpK+858MLT1w+Pvm+8H2:jsc1yQpprv+k6gKrzFI+mLT3Pvm+s

Score

10^/10

sality backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  e20565cf2241006ccc5dfa8ed10107e7d6a4dc68db2b08a9c6b5a64ac9b1d4f3
- Size
  
  1021KB
- MD5
  
  8cf987649a7e85a7e32023b57d70ce82
- SHA1
  
  add3505177fa3c67146d0d56695a7508a9a539e1
- SHA256
  
  e20565cf2241006ccc5dfa8ed10107e7d6a4dc68db2b08a9c6b5a64ac9b1d4f3
- SHA512
  
  5dc1e94f0352f2655c8832b4edad8451964a8553c1f383706df8997a1fe6b5dbb341cd365949ac86e60b6339e51004a5de7cd5e77d178b6997b18d6d275bf1ab
- SSDEEP
  
  12288:jsrHw1yQlMQwPopJ3Pn+roNkb/QZK1LgdBER4GzbhpK+858MLT1w+Pvm+8H2:jsc1yQpprv+k6gKrzFI+mLT3Pvm+s
Score

10^/10

sality backdoor discovery upx evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoordiscoveryupx

behavioral2

salitybackdoordiscoveryevasiontrojanupx