sality | 4ba49e1f864ef0116890eea6440d7a8562b498574c1d15467990f5860523572f | Triage

Submit
Reports

Overview

overview

Static

static

3

4ba49e1f86...2f.exe

windows7-x64

4ba49e1f86...2f.exe

windows10-2004-x64

Sharing

General

Target

4ba49e1f864ef0116890eea6440d7a8562b498574c1d15467990f5860523572f
Size

856KB
Sample

241223-m639fsyncz
MD5

0615ed5d5753d60dd6308523a7a8814e
SHA1

1e63142c48d890b59bbd82c77f435e6206631f1e
SHA256

4ba49e1f864ef0116890eea6440d7a8562b498574c1d15467990f5860523572f
SHA512

1d9b075b7bb4f693c6d0c0e62b40104f77dd6ba7b014541ff770376c18919609c20c4dd18dd1236966cc7721e7b274df6c439e30810c164f601b0adafe08226a
SSDEEP

24576:CECdXeb/rR0FPEGNiHWd0A/TPFMceJEvNrRe:pIFPEGNiHW9TtMHJoNVe

Score

10^/10

sality backdoor bootkit discovery evasion persistence trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4ba49e1f864ef0116890eea6440d7a8562b498574c1d15467990f5860523572f.exe

Resource

win7-20240903-en

sality backdoor bootkit discovery evasion persistence trojan upx

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral2

Sample

4ba49e1f864ef0116890eea6440d7a8562b498574c1d15467990f5860523572f.exe

Resource

win10v2004-20241007-en

sality backdoor bootkit discovery evasion persistence trojan upx

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  4ba49e1f864ef0116890eea6440d7a8562b498574c1d15467990f5860523572f
- Size
  
  856KB
- MD5
  
  0615ed5d5753d60dd6308523a7a8814e
- SHA1
  
  1e63142c48d890b59bbd82c77f435e6206631f1e
- SHA256
  
  4ba49e1f864ef0116890eea6440d7a8562b498574c1d15467990f5860523572f
- SHA512
  
  1d9b075b7bb4f693c6d0c0e62b40104f77dd6ba7b014541ff770376c18919609c20c4dd18dd1236966cc7721e7b274df6c439e30810c164f601b0adafe08226a
- SSDEEP
  
  24576:CECdXeb/rR0FPEGNiHWd0A/TPFMceJEvNrRe:pIFPEGNiHW9TtMHJoNVe
Score

10^/10

sality backdoor bootkit discovery evasion persistence trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Create or Modify System Process

Windows Service

Pre-OS Boot

Bootkit

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorbootkitdiscoveryevasionpersistencetrojanupx

behavioral2

salitybackdoorbootkitdiscoveryevasionpersistencetrojanupx

© 2018-2024

Terms | Privacy