(Cylance) The Sality virus infects local executables, removable storage, and remotely shared drives. It creates a peer-to-peer botnet which facilitates the downloading and execution of other malware. Sality can perform malicious code injection and modify its entry point to force code execution. This malware remains viable by adopting the successful strategies of other threats, implementing techniques like rootkit/backdoor capability, keylogging, and worm-like propagation.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|
| Domain | Timestamp |
|---|
| URL | Timestamp |
|---|---|
| http://89.119.67.154/testo5/ | 2023-10-30 |
| http://kukutrustnet777888.info/ | 2023-10-30 |
| http://klkjwre77638dfqwieuoi888.info/ | 2023-10-30 |
| http://www.klkjwre9fqwieluoi.info/ | 2023-10-30 |
2022-07-14 by Sam Hanson from Dragos
2022-04-20 by CISA from CISA
2022-04-20 by CISA from CISA
2021-10-27 by Ken Proska from Mandiant
2020-05-24 by Ajaya Neupane from Palo Alto Networks Unit 42
2017-10-29 by quangnh89 from
2017-05 by Lorenzo De Carli from IEEE
2015-12-02 by Peter Kleissner from Botconf
2011-07 by Nicolas Falliere from Symantec
Tool: Sality
Names: Sality, Sector, Kuku, SalLoad, Kookoo, SaliCode, Kukacka
Description: (Cylance) The Sality virus infects local executables, removable storage, and remotely shared drives. It creates a peer-to-peer botnet which facilitates the downloading and execution of other malware. Sality can perform malicious code injection and modify its entry point to force code execution. This malware remains viable by adopting the successful strategies of other threats, implementing techniques like rootkit/backdoor capability, keylogging, and worm-like propagation.
Category: Malware
Type: Botnet, Worm, Downloader, Loader
Information: https://threatvector.cylance.com/en_us/home/cylance-vs-sality-malware.html
Information: https://www.botconf.eu/wp-content/uploads/2015/12/OK-P18-Kleissner-Sality.pdf
Information: https://en.wikipedia.org/wiki/Sality
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.sality
Alienvault-otx: https://otx.alienvault.com/browse/pulses?q=tag:Sality
Last-card-change: 2020-05-24
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1573.002 ENCRYPTED CHANNEL : ASYMMETRIC CRYPTOGRAPHY tor encapsulates traffic in multiple layers of encryption, using tls by default. T1090.003 PROXY : MULTI-HOP PROXY traffic traversing the tor network will be forwarded to multiple nodes before exiting the tor network and continuing on to its intended destination. |