sality | 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73 | Triage

Sharing

General

Target

14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73
Size

1.4MB
Sample

241212-m9578atral
MD5

789e769ce9e544abee35a62420371d8f
SHA1

f1410949763c9386ff07b18e852a02bbeb3d7017
SHA256

14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73
SHA512

8a16f24eca845840a5213e4ed8c8812d2c09bba7f37e0d42a49788bc98633e8e46cd9cb69e3c9ee2616ff87cfa2fe15c794cd9099e363b2be39ed16184b84a08
SSDEEP

24576:HPhKDEa9xALCk5tIx8Eh6cy0UwPEnLW6pJTTnTTXTTgTTkTToTT6TTBTTTuTTWTI:HPva9xALCk5iucWYmW6pJTTnTTXTTgT9

Score

10^/10

sality backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73
- Size
  
  1.4MB
- MD5
  
  789e769ce9e544abee35a62420371d8f
- SHA1
  
  f1410949763c9386ff07b18e852a02bbeb3d7017
- SHA256
  
  14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73
- SHA512
  
  8a16f24eca845840a5213e4ed8c8812d2c09bba7f37e0d42a49788bc98633e8e46cd9cb69e3c9ee2616ff87cfa2fe15c794cd9099e363b2be39ed16184b84a08
- SSDEEP
  
  24576:HPhKDEa9xALCk5tIx8Eh6cy0UwPEnLW6pJTTnTTXTTgTTkTToTT6TTBTTTuTTWTI:HPva9xALCk5iucWYmW6pJTTnTTXTTgT9
Score

10^/10

discovery upx sality backdoor evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

salitybackdoordiscoveryevasiontrojanupx