sality | be2fef43548c98ce98015839f58cb4199afeb1c6ae344858145a6c23f73cd3d7 | Triage

Sharing

General

Target

be2fef43548c98ce98015839f58cb4199afeb1c6ae344858145a6c23f73cd3d7
Size

980KB
Sample

241213-g1kl9szres
MD5

6196969c1909ed8aeadb51b34df34d83
SHA1

88bd50c7f9d45bccc2834a84061c397de1688940
SHA256

be2fef43548c98ce98015839f58cb4199afeb1c6ae344858145a6c23f73cd3d7
SHA512

467fd49348c77f8486ac9472d2b99c270aa56f38515ebd16235569926699d2bb3c2a0d90b8707111f5169fd0585494ab9ac3409f6feeeabf3d0cd3c999392511
SSDEEP

12288:/g3oAHViDNkd+dqqWOmUcfKXiLR57TekmXSbVyVD49qWJkBUsZDZFRPMAJVlSE4x:dAHoBkd+dqROLceK7erD0qHDZvPMSaRB

Score

10^/10

sality backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  be2fef43548c98ce98015839f58cb4199afeb1c6ae344858145a6c23f73cd3d7
- Size
  
  980KB
- MD5
  
  6196969c1909ed8aeadb51b34df34d83
- SHA1
  
  88bd50c7f9d45bccc2834a84061c397de1688940
- SHA256
  
  be2fef43548c98ce98015839f58cb4199afeb1c6ae344858145a6c23f73cd3d7
- SHA512
  
  467fd49348c77f8486ac9472d2b99c270aa56f38515ebd16235569926699d2bb3c2a0d90b8707111f5169fd0585494ab9ac3409f6feeeabf3d0cd3c999392511
- SSDEEP
  
  12288:/g3oAHViDNkd+dqqWOmUcfKXiLR57TekmXSbVyVD49qWJkBUsZDZFRPMAJVlSE4x:dAHoBkd+dqROLceK7erD0qHDZvPMSaRB
Score

10^/10

discovery sality backdoor evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

salitybackdoordiscoveryevasiontrojanupx