sality | bf0eb6317ccea7f4aa9c6899735e17e9a7475fb40618a7aa8515da5e37e84b91 | Triage

Sharing

General

Target

2025-01-28_d2bff9383835a40a6815ce583226e5fa_floxif_icedid
Size

8.2MB
Sample

250128-1mt4bsslc1
MD5

d2bff9383835a40a6815ce583226e5fa
SHA1

dd1f9bbe79e592ddc3594d8440e262c2db7650ae
SHA256

bf0eb6317ccea7f4aa9c6899735e17e9a7475fb40618a7aa8515da5e37e84b91
SHA512

5f4db74539ca797490770a283a7752086ef489a5272b1a36b8ccd97114c8ee8309741838621530610393f707443594a7af122408d4e07a5ea4a33aa9dba3eeb0
SSDEEP

196608:p+tPHw4W3gYrtIXgWfJqOFdv5Wr/lDuvsivd7uA0yPi9x0rgG9Vba8cTfqVVoV9h:p8HNXBf4JZKka7WyiCWLq0N55

Score

10^/10

sality backdoor defense_evasion discovery trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  2025-01-28_d2bff9383835a40a6815ce583226e5fa_floxif_icedid
- Size
  
  8.2MB
- MD5
  
  d2bff9383835a40a6815ce583226e5fa
- SHA1
  
  dd1f9bbe79e592ddc3594d8440e262c2db7650ae
- SHA256
  
  bf0eb6317ccea7f4aa9c6899735e17e9a7475fb40618a7aa8515da5e37e84b91
- SHA512
  
  5f4db74539ca797490770a283a7752086ef489a5272b1a36b8ccd97114c8ee8309741838621530610393f707443594a7af122408d4e07a5ea4a33aa9dba3eeb0
- SSDEEP
  
  196608:p+tPHw4W3gYrtIXgWfJqOFdv5Wr/lDuvsivd7uA0yPi9x0rgG9Vba8cTfqVVoV9h:p8HNXBf4JZKka7WyiCWLq0N55
Score

10^/10

sality backdoor defense_evasion discovery trojan upx
- Modifies firewall policy service
  defense_evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoordefense_evasiondiscoverytrojanupx

behavioral2

salitybackdoordefense_evasiondiscoverytrojanupx