sality | 377765e6db9b32b31178abcc12f75be26dc381bc0376466fa92334030bcc00e3 | Triage

Sharing

General

Target

377765e6db9b32b31178abcc12f75be26dc381bc0376466fa92334030bcc00e3.exe
Size

483KB
Sample

241217-z8961aykgw
MD5

2338d9dd5a26364c6ad63ea403f5208d
SHA1

22c8fcce2b983ac77a50b2b21e355801173be2cc
SHA256

377765e6db9b32b31178abcc12f75be26dc381bc0376466fa92334030bcc00e3
SHA512

ba9b56a2a45e05633e326490fef66840fb543875f34375ef29997b91fb6acbda0c2a97ed5096936f63a27aad56ea817e4fc817716f116c7fe5c25f0b30cdae21
SSDEEP

12288:7ORXMExJ7REzeA82PYY6ZaHHBQQvJfOAaygfGhfh1auuZrgZDj:7OR8I7WzeA8EYY6ZKhQQvVOAaycGhfhH

Score

10^/10

sality backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  377765e6db9b32b31178abcc12f75be26dc381bc0376466fa92334030bcc00e3.exe
- Size
  
  483KB
- MD5
  
  2338d9dd5a26364c6ad63ea403f5208d
- SHA1
  
  22c8fcce2b983ac77a50b2b21e355801173be2cc
- SHA256
  
  377765e6db9b32b31178abcc12f75be26dc381bc0376466fa92334030bcc00e3
- SHA512
  
  ba9b56a2a45e05633e326490fef66840fb543875f34375ef29997b91fb6acbda0c2a97ed5096936f63a27aad56ea817e4fc817716f116c7fe5c25f0b30cdae21
- SSDEEP
  
  12288:7ORXMExJ7REzeA82PYY6ZaHHBQQvJfOAaygfGhfh1auuZrgZDj:7OR8I7WzeA8EYY6ZKhQQvVOAaycGhfhH
Score

10^/10

upx sality backdoor discovery evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

salitybackdoordiscoveryevasiontrojanupx