sality | de722a6153ae5583d9971caeb174432994d1701f215d3ffa5f725ef102e37863

Sharing

Copy URL Twitter E-mail

General

Target
de722a6153ae5583d9971caeb174432994d1701f215d3ffa5f725ef102e37863
Size 6.3MB
Sample260730-dvebhsssaz
SHA256 de722a6153ae5583d9971caeb174432994d1701f215d3ffa5f725ef102e37863
MD5 d15d3fc60e98adb26a9ba908692b9851
SHA1 ec993c10184a76dc667f8cef701e813fa11722da
SHA512 f4ad3bbe08a3945c24a974584358088f3b1aff102123d1e738322cca25256a6b0579a28fee77686b2bb2cd9db5adf29e58276babd991dc10fdc76b183d5b0f4b
SSDEEP 196608:UIfbpIY2SWJh5En+GZXbAPL2sbtpQuWFVaSY5Sdfcsr:UIt2hh+n+G1zSlWFtY5qft
TLSH
T1BA6633A65C0DCE788022E7F8843DCC9946A4FC754013DFFF29785A15BB16A1ACDE2A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif

Targets

- Target
  联软扫描异常exe文件/115Chrome.lnk
- Size 208B
- SHA256 49d4e73f0ccbb4e6e3967f6f38efa413cbd368ae02cad046a7458912b7059e04
- MD5 b17996676d168c641d0a2ec08328124c
- SHA1 c67ef1139bb831a094fd43b5bda4864e06bf712a
- SHA512 309ac1753403a8fbb579e9747a851441321678a6b4b4cf7fdba0857ef2f21499cdedfa2214ce22b7eefbcd815431367384b598c679cbab7ab81ee0dd0483c92f
- TLSH
  T1ACD02B0C3496D403E673C430C0F72BD35A2078003D0A314802C0491F0DF1020B101006
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  联软扫描异常exe文件/2345PinyinTool.exe
- Size 1.9MB
- SHA256 7ddb3979160eb92c464d00e199ab2c8904d669aed9470fc069e98b9384b05dea
- MD5 c78499ca71349fb78f9736949434351a
- SHA1 4eaac121d63ea398b253656609518c35607e48f3
- SHA512 16e88fbcc24bacd8a11844a92d0f393b6f395a1cb74d225fa8781ab7456adcfd6c8c6839f2d0a6e73a79f6682dbd96ff7e18fec6b217245947cc509bafb54d97
- SSDEEP 49152:bnGddef8mJpipnj3qTufHCH6XM1wf3+cGy:bUKDpipo6XMU
- TLSH
  T138954A307202C13BC56201B0996CDEAF5059BE242B65E4D7A3E43F7AD4715F35A32EAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery sality trojan upx
- Family: Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Modifies firewall policy service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  联软扫描异常exe文件/360Bookmarks.lnk
- Size 208B
- SHA256 49d4e73f0ccbb4e6e3967f6f38efa413cbd368ae02cad046a7458912b7059e04
- MD5 b17996676d168c641d0a2ec08328124c
- SHA1 c67ef1139bb831a094fd43b5bda4864e06bf712a
- SHA512 309ac1753403a8fbb579e9747a851441321678a6b4b4cf7fdba0857ef2f21499cdedfa2214ce22b7eefbcd815431367384b598c679cbab7ab81ee0dd0483c92f
- TLSH
  T1ACD02B0C3496D403E673C430C0F72BD35A2078003D0A314802C0491F0DF1020B101006
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  联软扫描异常exe文件/635026a75c2b7c2d19c9c546f33051cc692f002e0f47eb4f.bin.lnk
- Size 208B
- SHA256 49d4e73f0ccbb4e6e3967f6f38efa413cbd368ae02cad046a7458912b7059e04
- MD5 b17996676d168c641d0a2ec08328124c
- SHA1 c67ef1139bb831a094fd43b5bda4864e06bf712a
- SHA512 309ac1753403a8fbb579e9747a851441321678a6b4b4cf7fdba0857ef2f21499cdedfa2214ce22b7eefbcd815431367384b598c679cbab7ab81ee0dd0483c92f
- TLSH
  T1ACD02B0C3496D403E673C430C0F72BD35A2078003D0A314802C0491F0DF1020B101006
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  联软扫描异常exe文件/AppData.lnk
- Size 208B
- SHA256 49d4e73f0ccbb4e6e3967f6f38efa413cbd368ae02cad046a7458912b7059e04
- MD5 b17996676d168c641d0a2ec08328124c
- SHA1 c67ef1139bb831a094fd43b5bda4864e06bf712a
- SHA512 309ac1753403a8fbb579e9747a851441321678a6b4b4cf7fdba0857ef2f21499cdedfa2214ce22b7eefbcd815431367384b598c679cbab7ab81ee0dd0483c92f
- TLSH
  T1ACD02B0C3496D403E673C430C0F72BD35A2078003D0A314802C0491F0DF1020B101006
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  联软扫描异常exe文件/Bookmarks.lnk
- Size 208B
- SHA256 49d4e73f0ccbb4e6e3967f6f38efa413cbd368ae02cad046a7458912b7059e04
- MD5 b17996676d168c641d0a2ec08328124c
- SHA1 c67ef1139bb831a094fd43b5bda4864e06bf712a
- SHA512 309ac1753403a8fbb579e9747a851441321678a6b4b4cf7fdba0857ef2f21499cdedfa2214ce22b7eefbcd815431367384b598c679cbab7ab81ee0dd0483c92f
- TLSH
  T1ACD02B0C3496D403E673C430C0F72BD35A2078003D0A314802C0491F0DF1020B101006
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  联软扫描异常exe文件/Favicons.lnk
- Size 208B
- SHA256 49d4e73f0ccbb4e6e3967f6f38efa413cbd368ae02cad046a7458912b7059e04
- MD5 b17996676d168c641d0a2ec08328124c
- SHA1 c67ef1139bb831a094fd43b5bda4864e06bf712a
- SHA512 309ac1753403a8fbb579e9747a851441321678a6b4b4cf7fdba0857ef2f21499cdedfa2214ce22b7eefbcd815431367384b598c679cbab7ab81ee0dd0483c92f
- TLSH
  T1ACD02B0C3496D403E673C430C0F72BD35A2078003D0A314802C0491F0DF1020B101006
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  联软扫描异常exe文件/Haozip_2345Upgrade.exe
- Size 253KB
- SHA256 3d6016654a1a017f5497eb33fb47cbe9fd30df82dde406f37f8722cd545e6f1e
- MD5 0cc9511d456581f1d7153a2f0fc37f25
- SHA1 7d2e63c9ea0382ff99b11b25835a9dd4a7c680ef
- SHA512 95dd0faf5d7a8b2c99d6f3e8fe4132f64cb90805ca292dc89325cfab73879c5b8e5b2970315dce3a69453ae65d59c673d8bae0be113bd27cd8099755702be53b
- SSDEEP 6144:o3JgdDHKayX7nU5dijWrpmf3Q/Hj+aG2t9Is:oZkDyX7n0YjW4f3oHj+F2Xx
- TLSH
  T10744CE257A86D1B1CD87023415E9FF39447BFB718B204EC7B3881B5E29213E26637A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral15 behavioral16
- Target
  联软扫描异常exe文件/Local State.lnk
- Size 208B
- SHA256 de1319f19e2ac08262ee8e1a8c4d707b230b56913ce1114fce1b332421cd3d2a
- MD5 251bb618ed11b41bf3e1c2588f14708f
- SHA1 03c8ff9a073f2a40a3ca5b6ef3ada2008337aade
- SHA512 0293407530ea5050cdc272e7f7a28a9acf724f8fd211cbafcd69ec3c4a075e2e94179a11f9f54cea489d5c5d372a094be74c6abbb6eac8cef3f52cadcdfd7043
- TLSH
  T1CED02B0C345AD403E633C53080E72BD34E3078003D0A318402C0491F0DF1020F502106
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  联软扫描异常exe文件/Local Storage.lnk
- Size 208B
- SHA256 de1319f19e2ac08262ee8e1a8c4d707b230b56913ce1114fce1b332421cd3d2a
- MD5 251bb618ed11b41bf3e1c2588f14708f
- SHA1 03c8ff9a073f2a40a3ca5b6ef3ada2008337aade
- SHA512 0293407530ea5050cdc272e7f7a28a9acf724f8fd211cbafcd69ec3c4a075e2e94179a11f9f54cea489d5c5d372a094be74c6abbb6eac8cef3f52cadcdfd7043
- TLSH
  T1CED02B0C345AD403E633C53080E72BD34E3078003D0A318402C0491F0DF1020F502106
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  联软扫描异常exe文件/QQProtect.exe
- Size 176KB
- SHA256 99703f1637896f4c1f420d7b4d50771df7549c8bf4fd634b7529e55a4f42ce3e
- MD5 e77eb6d1acb008d5ca63716d62cdeaa9
- SHA1 ea861c518f6b200565360f16072b02c5f62fdad8
- SHA512 aa680f67a5bc222ef5d5c1ef925dec99b4ed1be8b9d57a89d6a09cb85d1aba52560547a4d921c09327c74fdfcb63e1a42ac65deab3f813dc3a4b004fd119aa6c
- SSDEEP 3072:Rdp5u+H2S+bkw8Z4UB8OyHUVCHkAW5CYQ0MJqeFQigr3t0:Rdp5bHp5048Oy0rfCYFMJqeG1q
- TLSH
  T11704BF11B7C1CA36FED241B299A5B6BA473BF2330B5A11C7B37806574A9C7E06D3421B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  联软扫描异常exe文件/QQWBService.exe
- Size 238KB
- SHA256 7f6ecef926aaf54710cab5af93517cb7f56c74f12b95a8d5270b0313fcd0e372
- MD5 61e2ac26916f6e7da7d7ef493adc1fc3
- SHA1 61edabc48e3722785b6c6f7b4745aad732c2f307
- SHA512 a2f0b6fbd8550d9c83ce978a5fc185d1dd367abf529b23b274990df04588cda15d11a0fbf423854872ff4bebcf443c4133f1075779a143529434c6d69fb5aaa9
- SSDEEP 6144:Hi8qkojvC/yCp6FmGyQddBYnavSPgVW3cr:Lq5jvC/4mM0nYVAcr
- TLSH
  T10D34AE1175C1C4B2E9A7193019B4DB726E2DFE300F718EEB6398237A1F702D15A39A67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery sality upx
- Family: Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral23 behavioral24
- Target
  联软扫描异常exe文件/ToolsSearchCacheAcro.lnk
- Size 208B
- SHA256 49d4e73f0ccbb4e6e3967f6f38efa413cbd368ae02cad046a7458912b7059e04
- MD5 b17996676d168c641d0a2ec08328124c
- SHA1 c67ef1139bb831a094fd43b5bda4864e06bf712a
- SHA512 309ac1753403a8fbb579e9747a851441321678a6b4b4cf7fdba0857ef2f21499cdedfa2214ce22b7eefbcd815431367384b598c679cbab7ab81ee0dd0483c92f
- TLSH
  T1ACD02B0C3496D403E673C430C0F72BD35A2078003D0A314802C0491F0DF1020B101006
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  联软扫描异常exe文件/Top Sites.lnk
- Size 208B
- SHA256 de1319f19e2ac08262ee8e1a8c4d707b230b56913ce1114fce1b332421cd3d2a
- MD5 251bb618ed11b41bf3e1c2588f14708f
- SHA1 03c8ff9a073f2a40a3ca5b6ef3ada2008337aade
- SHA512 0293407530ea5050cdc272e7f7a28a9acf724f8fd211cbafcd69ec3c4a075e2e94179a11f9f54cea489d5c5d372a094be74c6abbb6eac8cef3f52cadcdfd7043
- TLSH
  T1CED02B0C345AD403E633C53080E72BD34E3078003D0A318402C0491F0DF1020F502106
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  联软扫描异常exe文件/Upgrade_2345Explorer.exe
- Size 284KB
- SHA256 435810ad5855fe5236310b7d36370854dc9881b52525d9691d29542eb2a51d82
- MD5 73e491fe34133e3b871f3aed4108a6f7
- SHA1 f1607ebbf85a810c56efd6661f2fbfb22734265e
- SHA512 69b4b7ca8da172bbd9f8422ee273e1c69ebb6cb4773e73c7903a225f8081d9c6b5153b16eb9249ac423430dd896c37258f938e54f2be3c571c9231b110456863
- SSDEEP 3072:r4vxBPlfcrC8enIEpY5E/J1Ko3sHQzmPkwWYZfh+9FNsPFfau8M4pMppS84GOx9x:rq3f55Y5EB1Ko3fmyYXDPvvS84p0w7H
- TLSH
  T10154BF14BE86C2B2DD5B013415F8FF2E847ABA524B608DC7E7880F5F29217D166337A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery sality trojan upx
- Family: Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Modifies firewall policy service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral29 behavioral30
- Target
  联软扫描异常exe文件/User Data.lnk
- Size 208B
- SHA256 de1319f19e2ac08262ee8e1a8c4d707b230b56913ce1114fce1b332421cd3d2a
- MD5 251bb618ed11b41bf3e1c2588f14708f
- SHA1 03c8ff9a073f2a40a3ca5b6ef3ada2008337aade
- SHA512 0293407530ea5050cdc272e7f7a28a9acf724f8fd211cbafcd69ec3c4a075e2e94179a11f9f54cea489d5c5d372a094be74c6abbb6eac8cef3f52cadcdfd7043
- TLSH
  T1CED02B0C345AD403E633C53080E72BD34E3078003D0A318402C0491F0DF1020F502106
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Sality

Modifies firewall policy service

UAC bypass

Windows security bypass

Windows security modification

Checks whether UAC is enabled

UPX packed file

UPX packed file

Family: Sality

UPX packed file

Family: Sality

Modifies firewall policy service

UAC bypass

Windows security bypass

Windows security modification

Checks whether UAC is enabled

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32