sality | 17cb043884f9c10afda3b7feffea2ac2d93dd7cd0836266d632d5056142f3987 | Triage

Sharing

General

Target

JaffaCakes118_a9f27fad4d698c0895eb131d6db8ed1b
Size

287KB
Sample

250206-l29d8stldr
MD5

a9f27fad4d698c0895eb131d6db8ed1b
SHA1

346fb32944f885fa1fbcd1a2ed1a867fae466e2b
SHA256

17cb043884f9c10afda3b7feffea2ac2d93dd7cd0836266d632d5056142f3987
SHA512

375415567ba8ebd3e123c9be2c69f01c6678873f2786f03b8d604cb0703dd71db37c4dc90f4dc90f80666b196b2f8eab19f20e402dc83aa5e19a88d73984c262
SSDEEP

3072:f+/XpaIC/jdelKE90KmIJQ3FKrKOYHhph3Z0ojWPTKGloGjHlJ7gB968Z7/CZTHQ:f+/Xpq8z4K14huXRWp

Score

10^/10

sality backdoor defense_evasion discovery persistence privilege_escalation trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  JaffaCakes118_a9f27fad4d698c0895eb131d6db8ed1b
- Size
  
  287KB
- MD5
  
  a9f27fad4d698c0895eb131d6db8ed1b
- SHA1
  
  346fb32944f885fa1fbcd1a2ed1a867fae466e2b
- SHA256
  
  17cb043884f9c10afda3b7feffea2ac2d93dd7cd0836266d632d5056142f3987
- SHA512
  
  375415567ba8ebd3e123c9be2c69f01c6678873f2786f03b8d604cb0703dd71db37c4dc90f4dc90f80666b196b2f8eab19f20e402dc83aa5e19a88d73984c262
- SSDEEP
  
  3072:f+/XpaIC/jdelKE90KmIJQ3FKrKOYHhph3Z0ojWPTKGloGjHlJ7gB968Z7/CZTHQ:f+/Xpq8z4K14huXRWp
Score

10^/10

discovery sality backdoor defense_evasion persistence privilege_escalation trojan upx
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Sality family
  sality
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

salitybackdoordefense_evasiondiscoverypersistenceprivilege_escalationtrojanupx