General
-
Target
4f4de480e5c4233b8f81e0983e4c515b9d47cf7b10cbb552b2508e404199af8a
-
Size
192KB
-
Sample
220720-r8a3xagaf3
-
MD5
29b8a5e18d1fe0736724763ac2c2f122
-
SHA1
ebea2a2023fe5897edf8522282e17081a10accd3
-
SHA256
4f4de480e5c4233b8f81e0983e4c515b9d47cf7b10cbb552b2508e404199af8a
-
SHA512
1c2a6345638ea5220d943039a25dbfc22b78fb262ad4a0990aaa4440ddf70fc14ddbbd82f0d36333492884039d869c6fae580c1fbd904cc29b6a9ab64c8d0f29
Static task
static1
Behavioral task
behavioral1
Sample
4f4de480e5c4233b8f81e0983e4c515b9d47cf7b10cbb552b2508e404199af8a.exe
Resource
win7-20220718-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
4f4de480e5c4233b8f81e0983e4c515b9d47cf7b10cbb552b2508e404199af8a
-
Size
192KB
-
MD5
29b8a5e18d1fe0736724763ac2c2f122
-
SHA1
ebea2a2023fe5897edf8522282e17081a10accd3
-
SHA256
4f4de480e5c4233b8f81e0983e4c515b9d47cf7b10cbb552b2508e404199af8a
-
SHA512
1c2a6345638ea5220d943039a25dbfc22b78fb262ad4a0990aaa4440ddf70fc14ddbbd82f0d36333492884039d869c6fae580c1fbd904cc29b6a9ab64c8d0f29
-
Modifies firewall policy service
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-