sality | 7faf9f070116053e441d83bdb88c8209cb9d3c30ba2133bc9d8245df4b643dbc | Triage

Sharing

General

Target

JaffaCakes118_669bca0c50f41024fe76c065f48f8de0
Size

4.5MB
Sample

250130-zzj88asqd1
MD5

669bca0c50f41024fe76c065f48f8de0
SHA1

e2d5111d6c6f700dd10590cf532d60c666291149
SHA256

7faf9f070116053e441d83bdb88c8209cb9d3c30ba2133bc9d8245df4b643dbc
SHA512

c1c39c35775288a15c8b391d4d0a0cf1ab53b10490e06f042ae146e35c4e64f9cbe20129a85c578ece682f0c879bca1d68d2b7975e84e68d9ac738614a057b63
SSDEEP

49152:5MsqVvPCPXnBu+PJqBT61oquzqWntWejTftVvhX0fZDXezKjjAq5LYsS85aCRQut:ypf+3/59VHpRTboT7ei/HoF2SHpcBsPf

Score

10^/10

sality backdoor defense_evasion discovery trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  JaffaCakes118_669bca0c50f41024fe76c065f48f8de0
- Size
  
  4.5MB
- MD5
  
  669bca0c50f41024fe76c065f48f8de0
- SHA1
  
  e2d5111d6c6f700dd10590cf532d60c666291149
- SHA256
  
  7faf9f070116053e441d83bdb88c8209cb9d3c30ba2133bc9d8245df4b643dbc
- SHA512
  
  c1c39c35775288a15c8b391d4d0a0cf1ab53b10490e06f042ae146e35c4e64f9cbe20129a85c578ece682f0c879bca1d68d2b7975e84e68d9ac738614a057b63
- SSDEEP
  
  49152:5MsqVvPCPXnBu+PJqBT61oquzqWntWejTftVvhX0fZDXezKjjAq5LYsS85aCRQut:ypf+3/59VHpRTboT7ei/HoF2SHpcBsPf
Score

10^/10

sality backdoor defense_evasion discovery trojan upx
- Modifies firewall policy service
  defense_evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoordefense_evasiondiscoverytrojanupx

behavioral2

salitybackdoordefense_evasiondiscoverytrojanupx