sality | 32a7e944f7c437d3341f18dd253d20864de0a431eac9036ff508e238d6d92ef5 | Triage

Sharing

General

Target

JaffaCakes118_a9513a7319f168045975d585a2ae91ce
Size

119KB
Sample

250206-kpt84ssjaq
MD5

a9513a7319f168045975d585a2ae91ce
SHA1

2a6cafd5d07cc4efd331cc0c95b3e767853250ff
SHA256

32a7e944f7c437d3341f18dd253d20864de0a431eac9036ff508e238d6d92ef5
SHA512

71c77523183699bdd2db5171c981de784ff9671f1effd4908f47ec578e4f7b66362a3218c96df2fdc8c66aff914598efed9eae2c37f7e5e2937cd05eeaebc89f
SSDEEP

3072:IiMn1F1CkOCRtnA3K6pAOkvAfTT9BxY27Ol3OwCnE+3D:IR1vjnB6p4vWrxf7CO/EgD

Score

10^/10

sality backdoor defense_evasion discovery trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  JaffaCakes118_a9513a7319f168045975d585a2ae91ce
- Size
  
  119KB
- MD5
  
  a9513a7319f168045975d585a2ae91ce
- SHA1
  
  2a6cafd5d07cc4efd331cc0c95b3e767853250ff
- SHA256
  
  32a7e944f7c437d3341f18dd253d20864de0a431eac9036ff508e238d6d92ef5
- SHA512
  
  71c77523183699bdd2db5171c981de784ff9671f1effd4908f47ec578e4f7b66362a3218c96df2fdc8c66aff914598efed9eae2c37f7e5e2937cd05eeaebc89f
- SSDEEP
  
  3072:IiMn1F1CkOCRtnA3K6pAOkvAfTT9BxY27Ol3OwCnE+3D:IR1vjnB6p4vWrxf7CO/EgD
Score

10^/10

sality backdoor discovery upx defense_evasion trojan
- Modifies firewall policy service
  defense_evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoordiscoveryupx

behavioral2

salitybackdoordefense_evasiondiscoverytrojanupx