sality | 7147cf560cc54c00a7ba3ff5bf25bb06d11509c92f65a2d9b986d51a9f0e8ae0 | Triage

Sharing

General

Target

2024-12-24_51e8e3e5110b8c5d5ec665dff73dfbd9_cobalt-strike_luca-stealer_magniber
Size

763KB
Sample

241224-p2k87axpbs
MD5

51e8e3e5110b8c5d5ec665dff73dfbd9
SHA1

d23c4c89677e49e4276f2720cab73891dea5cb17
SHA256

7147cf560cc54c00a7ba3ff5bf25bb06d11509c92f65a2d9b986d51a9f0e8ae0
SHA512

ee7c116b0b06924edb23dd9014b7f5c4179453d3b333586b56b175a6adb76c287d997cdd36787ee089229af288c29fa20be2e5ad38a52ed1b787736aae710b76
SSDEEP

12288:sAjnak2gv3CxDLI45VxRRfG7tSNP37djx4E94vEZvtwDSV8KIg/e2wsBRwnGkwj7:skaYyigxrFdjx4E9CEZGSVDPwsBRsGkS

Score

10^/10

sality backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  2024-12-24_51e8e3e5110b8c5d5ec665dff73dfbd9_cobalt-strike_luca-stealer_magniber
- Size
  
  763KB
- MD5
  
  51e8e3e5110b8c5d5ec665dff73dfbd9
- SHA1
  
  d23c4c89677e49e4276f2720cab73891dea5cb17
- SHA256
  
  7147cf560cc54c00a7ba3ff5bf25bb06d11509c92f65a2d9b986d51a9f0e8ae0
- SHA512
  
  ee7c116b0b06924edb23dd9014b7f5c4179453d3b333586b56b175a6adb76c287d997cdd36787ee089229af288c29fa20be2e5ad38a52ed1b787736aae710b76
- SSDEEP
  
  12288:sAjnak2gv3CxDLI45VxRRfG7tSNP37djx4E94vEZvtwDSV8KIg/e2wsBRwnGkwj7:skaYyigxrFdjx4E9CEZGSVDPwsBRsGkS
Score

10^/10

sality backdoor discovery upx evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoordiscoveryupx

behavioral2

salitybackdoordiscoveryevasiontrojanupx