sality | 22adb28071c76b60a5c4469fd159a3e81466661ed350a6d3e717813a5989f268 | Triage

Sharing

General

Target

JaffaCakes118_a00ebb75c2a5414e00ac534eabaf552e
Size

67KB
Sample

250205-qqtxmazlgr
MD5

a00ebb75c2a5414e00ac534eabaf552e
SHA1

735dd7bbdc018249808aba3641333bdd5d2081a0
SHA256

22adb28071c76b60a5c4469fd159a3e81466661ed350a6d3e717813a5989f268
SHA512

7409598c4d182cf22b6270e088ae9ac4831e28088df54d987cd8b7a214a22f57ea61c31faa182311018d00c74d579cc6633a74990b662b4c4c8d35e4f21b41cf
SSDEEP

768:oBkfKY4umiPCAcdBrq06iqmNKzshw0xTJYc8VKU0n7OdwmdZfB5AVKBjPw2EqZM:yU8cO7u2NbvdOc8VKUaOdNdRzMKwqZM

Score

10^/10

sality backdoor defense_evasion discovery trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  JaffaCakes118_a00ebb75c2a5414e00ac534eabaf552e
- Size
  
  67KB
- MD5
  
  a00ebb75c2a5414e00ac534eabaf552e
- SHA1
  
  735dd7bbdc018249808aba3641333bdd5d2081a0
- SHA256
  
  22adb28071c76b60a5c4469fd159a3e81466661ed350a6d3e717813a5989f268
- SHA512
  
  7409598c4d182cf22b6270e088ae9ac4831e28088df54d987cd8b7a214a22f57ea61c31faa182311018d00c74d579cc6633a74990b662b4c4c8d35e4f21b41cf
- SSDEEP
  
  768:oBkfKY4umiPCAcdBrq06iqmNKzshw0xTJYc8VKU0n7OdwmdZfB5AVKBjPw2EqZM:yU8cO7u2NbvdOc8VKUaOdNdRzMKwqZM
Score

10^/10

sality backdoor defense_evasion trojan upx discovery
- Modifies firewall policy service
  defense_evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoordefense_evasiontrojanupx

behavioral2

salitybackdoordefense_evasiondiscoverytrojanupx