sality | f85b9db7d5e956ee24de4d5dc97c7b0444e3b3a73317d40f836a0ae18ec9be1b | Triage

Sharing

General

Target

JaffaCakes118_771345e48da8ae1d139c939c9d9ce71c
Size

196KB
Sample

250202-amkxjswrcw
MD5

771345e48da8ae1d139c939c9d9ce71c
SHA1

e60b69f3d65eb1495d7f446a5d37fdb3bbc6a194
SHA256

f85b9db7d5e956ee24de4d5dc97c7b0444e3b3a73317d40f836a0ae18ec9be1b
SHA512

a7d30b3e528a8682732cb968028db863d43f886ed13981965e58e0907ee5cbad3881738eb3fa60cee2d283178ccde9fedf8d1a55c96e45eda29c679f69e83c3c
SSDEEP

3072:SMKup+nXYlKzgxDTS9bDdIzo86w9MiAb8jZkS5rr2LhXigZ9bhxVRyqC2/iQWR:RP+nIJabI9MQjZkS5H2FXigrtx762qB

Score

10^/10

sality backdoor defense_evasion discovery trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  JaffaCakes118_771345e48da8ae1d139c939c9d9ce71c
- Size
  
  196KB
- MD5
  
  771345e48da8ae1d139c939c9d9ce71c
- SHA1
  
  e60b69f3d65eb1495d7f446a5d37fdb3bbc6a194
- SHA256
  
  f85b9db7d5e956ee24de4d5dc97c7b0444e3b3a73317d40f836a0ae18ec9be1b
- SHA512
  
  a7d30b3e528a8682732cb968028db863d43f886ed13981965e58e0907ee5cbad3881738eb3fa60cee2d283178ccde9fedf8d1a55c96e45eda29c679f69e83c3c
- SSDEEP
  
  3072:SMKup+nXYlKzgxDTS9bDdIzo86w9MiAb8jZkS5rr2LhXigZ9bhxVRyqC2/iQWR:RP+nIJabI9MQjZkS5H2FXigrtx762qB
Score

10^/10

discovery sality backdoor defense_evasion trojan upx
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

salitybackdoordefense_evasiondiscoverytrojanupx