sality | f30f66c371cfcc1d758228ed5c5da872d024358cb407c0679fdf198469e8ec3f | Triage

Sharing

General

Target

JaffaCakes118_45987f02da7e988298cb984c1a63e160
Size

488KB
Sample

250101-d2td1stjbx
MD5

45987f02da7e988298cb984c1a63e160
SHA1

12c0bea4c2ae7dc12f0a1887943ed8dd07ff20ad
SHA256

f30f66c371cfcc1d758228ed5c5da872d024358cb407c0679fdf198469e8ec3f
SHA512

723d0266aa7c9427b6a97204a15d6463c28262f50fbf507d2e3d66557902e607bd17f0c3ab69c99cd6bd4bf9f27ca12a4c1aa6dc5f80bb7271979c4722ba6e96
SSDEEP

6144:zhybolrUq/P3RLw/GzrS+Rbut8JcoBQ+i4NOEhBemB21Vm0t/+:zhy8gq/PBc/GzrVbu+JGC7hBeVm0t/+

Score

10^/10

sality backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  JaffaCakes118_45987f02da7e988298cb984c1a63e160
- Size
  
  488KB
- MD5
  
  45987f02da7e988298cb984c1a63e160
- SHA1
  
  12c0bea4c2ae7dc12f0a1887943ed8dd07ff20ad
- SHA256
  
  f30f66c371cfcc1d758228ed5c5da872d024358cb407c0679fdf198469e8ec3f
- SHA512
  
  723d0266aa7c9427b6a97204a15d6463c28262f50fbf507d2e3d66557902e607bd17f0c3ab69c99cd6bd4bf9f27ca12a4c1aa6dc5f80bb7271979c4722ba6e96
- SSDEEP
  
  6144:zhybolrUq/P3RLw/GzrS+Rbut8JcoBQ+i4NOEhBemB21Vm0t/+:zhy8gq/PBc/GzrVbu+JGC7hBeVm0t/+
Score

10^/10

sality backdoor discovery evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoordiscoveryevasiontrojanupx

behavioral2

salitybackdoordiscoveryupx