sality

Sharing

Copy URL

Twitter E-mail

General

Target

ea1b19191368c40a9d1722bb1cb9d4aa_JaffaCakes118
Size

140KB
Sample

241213-f6cyya1pak
MD5

ea1b19191368c40a9d1722bb1cb9d4aa
SHA1

bc0bd2063a42dc7be9925483f8f04ffd55fcb43b
SHA256

0de4a678e800e419360596f186e927de031e92bbc697e771882fa33bb94ffe1e
SHA512

05f5fbed9b6f349ebd5c8dbd691f141045cf502ed8e65703666367643c952f2a1c86a81e8bdb4ccf775001ba832ebc122dd2bb1aa233796531efb849e4fcb781
SSDEEP

3072:hQInRTXJFceAf5Nl0LB8ViuODq3fV5+WHf:h3Tmf5AB8fO0fV5+Kf

Score

10^/10

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  ea1b19191368c40a9d1722bb1cb9d4aa_JaffaCakes118
- Size
  
  140KB
- MD5
  
  ea1b19191368c40a9d1722bb1cb9d4aa
- SHA1
  
  bc0bd2063a42dc7be9925483f8f04ffd55fcb43b
- SHA256
  
  0de4a678e800e419360596f186e927de031e92bbc697e771882fa33bb94ffe1e
- SHA512
  
  05f5fbed9b6f349ebd5c8dbd691f141045cf502ed8e65703666367643c952f2a1c86a81e8bdb4ccf775001ba832ebc122dd2bb1aa233796531efb849e4fcb781
- SSDEEP
  
  3072:hQInRTXJFceAf5Nl0LB8ViuODq3fV5+WHf:h3Tmf5AB8fO0fV5+Kf
Score

10^/10

sality backdoor discovery evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/InstallOptions.dll
- Size
  
  14KB
- MD5
  
  325b008aec81e5aaa57096f05d4212b5
- SHA1
  
  27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA256
  
  c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- SHA512
  
  18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP
  
  192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/UserInfo.dll
- Size
  
  4KB
- MD5
  
  7579ade7ae1747a31960a228ce02e666
- SHA1
  
  8ec8571a296737e819dcf86353a43fcf8ec63351
- SHA256
  
  564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
- SHA512
  
  a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
Score

3^/10

discovery
behavioral7 behavioral8