General

  • Target

    03246df6b1557e796c033543695d589dd3d7a09c3199b88ee93cd791442818ec

  • Size

    333KB

  • Sample

    221002-fpc8dahfg6

  • MD5

    676794f79a5304634037f525cbb851ef

  • SHA1

    73b91b3bddc8e9164613eb9cb63d7d4ea3315e28

  • SHA256

    03246df6b1557e796c033543695d589dd3d7a09c3199b88ee93cd791442818ec

  • SHA512

    72e9808b6ebc90ebe80cead8bc2e16309653f41dc85158f9c3d9595d92edf6e79bcc55a1b986c3d4f51003df2e0b58cabc087bb73288dcf99fa6f44519a67bc4

  • SSDEEP

    6144:k9iy7qJKcHjhV4/LmRuSyj+1Bbg+phFawFawFaf:qqjDhVSmo8BblnrrG

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      03246df6b1557e796c033543695d589dd3d7a09c3199b88ee93cd791442818ec

    • Size

      333KB

    • MD5

      676794f79a5304634037f525cbb851ef

    • SHA1

      73b91b3bddc8e9164613eb9cb63d7d4ea3315e28

    • SHA256

      03246df6b1557e796c033543695d589dd3d7a09c3199b88ee93cd791442818ec

    • SHA512

      72e9808b6ebc90ebe80cead8bc2e16309653f41dc85158f9c3d9595d92edf6e79bcc55a1b986c3d4f51003df2e0b58cabc087bb73288dcf99fa6f44519a67bc4

    • SSDEEP

      6144:k9iy7qJKcHjhV4/LmRuSyj+1Bbg+phFawFawFaf:qqjDhVSmo8BblnrrG

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v6

Tasks