General
-
Target
ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5
-
Size
303KB
-
Sample
221123-talg4ade25
-
MD5
4ed2100f847ca6af006fb894c433b740
-
SHA1
82257c6724f7832830cabbbed0ebbd12335bdb1a
-
SHA256
ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5
-
SHA512
35aa432bc663c5b490c571ac8d15ea5fb3e301ad23d1014a98c3b7d5ec1c82c0f06995d4766c47180be52448821229530a556e35f71e57ac92b3d32ba0b475dc
-
SSDEEP
6144:64IumFnpizAyTjdOFrtX1kC/3sCnE/oweW215GcFm2jL:bI9ytwtXNsIE/r21lFmQL
Static task
static1
Behavioral task
behavioral1
Sample
ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5.exe
Resource
win7-20221111-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5
-
Size
303KB
-
MD5
4ed2100f847ca6af006fb894c433b740
-
SHA1
82257c6724f7832830cabbbed0ebbd12335bdb1a
-
SHA256
ac9897327901b6e866e307b059e605ac856e105c55b7cd8db48511c66bfc5ae5
-
SHA512
35aa432bc663c5b490c571ac8d15ea5fb3e301ad23d1014a98c3b7d5ec1c82c0f06995d4766c47180be52448821229530a556e35f71e57ac92b3d32ba0b475dc
-
SSDEEP
6144:64IumFnpizAyTjdOFrtX1kC/3sCnE/oweW215GcFm2jL:bI9ytwtXNsIE/r21lFmQL
-
Modifies firewall policy service
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-