General
-
Target
93ec6f5d92d4926b53cb057d1f49a90e4d5a6419fa4b478af7e8d3bc9ddfc807
-
Size
374KB
-
Sample
221127-b7pa5sbd25
-
MD5
1198bfeb7636b4702e7569f4b4a538b1
-
SHA1
a7850dd5c964f01996074152231c3255cdf35033
-
SHA256
93ec6f5d92d4926b53cb057d1f49a90e4d5a6419fa4b478af7e8d3bc9ddfc807
-
SHA512
b9d215b36fdb83df509a58697865831b142e3e007017aa60d83335dacf80715bb43ea54a04a6377d9738101acde7758004cb20f53ccad04d9aa7d25de25adee7
-
SSDEEP
6144:yuMJWY+qaHEQCcYfSBYJbQCjRcqESEgm6Anhc1kG6Evy6HVeAEUIRL7MBjae0w0v:y+YcUc6SBLLTSEgBAnhc1kGRmZ7MBT0v
Behavioral task
behavioral1
Sample
93ec6f5d92d4926b53cb057d1f49a90e4d5a6419fa4b478af7e8d3bc9ddfc807.exe
Resource
win7-20220812-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
93ec6f5d92d4926b53cb057d1f49a90e4d5a6419fa4b478af7e8d3bc9ddfc807
-
Size
374KB
-
MD5
1198bfeb7636b4702e7569f4b4a538b1
-
SHA1
a7850dd5c964f01996074152231c3255cdf35033
-
SHA256
93ec6f5d92d4926b53cb057d1f49a90e4d5a6419fa4b478af7e8d3bc9ddfc807
-
SHA512
b9d215b36fdb83df509a58697865831b142e3e007017aa60d83335dacf80715bb43ea54a04a6377d9738101acde7758004cb20f53ccad04d9aa7d25de25adee7
-
SSDEEP
6144:yuMJWY+qaHEQCcYfSBYJbQCjRcqESEgm6Anhc1kG6Evy6HVeAEUIRL7MBjae0w0v:y+YcUc6SBLLTSEgBAnhc1kGRmZ7MBT0v
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Adds Run key to start application
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-