General

  • Target

    ffaa9060474548b7b0252866bb38b9c837c38600cf59294eaa1c1ac06ecda63c

  • Size

    149KB

  • Sample

    221003-esa2raghel

  • MD5

    61d7732a7c5ec25c960df93e39301d59

  • SHA1

    a7e5f29f635ceb804111ddc71d9a76f259dbe99f

  • SHA256

    ffaa9060474548b7b0252866bb38b9c837c38600cf59294eaa1c1ac06ecda63c

  • SHA512

    bba3fcb05d137d1da0e5571fc6b8310518bd4a78d134c23e0a185ba72520e459dd04d5ff62168ccc1d0ce10c21c936490d74170d0a05d59a91765b6aa0698732

  • SSDEEP

    3072:ryFuu1ClNoX3eyPW8tcX/sK8+f3Az3esMOtA3:2FINKal/58+f3Az3esq

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      ffaa9060474548b7b0252866bb38b9c837c38600cf59294eaa1c1ac06ecda63c

    • Size

      149KB

    • MD5

      61d7732a7c5ec25c960df93e39301d59

    • SHA1

      a7e5f29f635ceb804111ddc71d9a76f259dbe99f

    • SHA256

      ffaa9060474548b7b0252866bb38b9c837c38600cf59294eaa1c1ac06ecda63c

    • SHA512

      bba3fcb05d137d1da0e5571fc6b8310518bd4a78d134c23e0a185ba72520e459dd04d5ff62168ccc1d0ce10c21c936490d74170d0a05d59a91765b6aa0698732

    • SSDEEP

      3072:ryFuu1ClNoX3eyPW8tcX/sK8+f3Az3esMOtA3:2FINKal/58+f3Az3esq

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • UAC bypass

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks