sality

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-30_a929042a85c0ebe291a1b2b55f948567_magniber
Size

2.9MB
Sample

240630-tb5x5azgkd
MD5

a929042a85c0ebe291a1b2b55f948567
SHA1

1211f45dc01988f0ba2f63b13e197af6e27603be
SHA256

e77d8392c09e6c1a42337f0079967c879bbf933358436a38791e4014f3ebfd7b
SHA512

1e9d36cb684d9d4b6be8efb02a30bf020d3661b6718ab3bcfbb62d9a2c0cedc9d37197443aad00a7a6db340a6cdebe268f1b5341282777ee2a2790d0f1417a2a
SSDEEP

49152:VpAJ4K/kZCRW6JIAYtBRVXJT8IE+eDvkX6uPh0OR8/dJ388mS5vbv+fH2rJnLs5V:gdkyIAYt3VXNeTkquPhO881Vv5LndS

Score

10^/10

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  2024-06-30_a929042a85c0ebe291a1b2b55f948567_magniber
- Size
  
  2.9MB
- MD5
  
  a929042a85c0ebe291a1b2b55f948567
- SHA1
  
  1211f45dc01988f0ba2f63b13e197af6e27603be
- SHA256
  
  e77d8392c09e6c1a42337f0079967c879bbf933358436a38791e4014f3ebfd7b
- SHA512
  
  1e9d36cb684d9d4b6be8efb02a30bf020d3661b6718ab3bcfbb62d9a2c0cedc9d37197443aad00a7a6db340a6cdebe268f1b5341282777ee2a2790d0f1417a2a
- SSDEEP
  
  49152:VpAJ4K/kZCRW6JIAYtBRVXJT8IE+eDvkX6uPh0OR8/dJ388mS5vbv+fH2rJnLs5V:gdkyIAYt3VXNeTkquPhO881Vv5LndS
Score

10^/10

sality backdoor bootkit evasion persistence trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
- UPX dump on OEP (original entry point)
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2