General
-
Target
c312fbc89e1f08c0e37d4cd2ac4c2190890d3735c7f8c0a2995606e42fd3edb9
-
Size
100KB
-
Sample
221127-x6p2yacg65
-
MD5
1461d59c12655be3ea1fc75252877d61
-
SHA1
b8c00950ee048ee0dab9c364b51916681ec64171
-
SHA256
c312fbc89e1f08c0e37d4cd2ac4c2190890d3735c7f8c0a2995606e42fd3edb9
-
SHA512
341921e91762615f76cc0f2ac4d1a5032ab2b224ab7ee06894811e8747566bdd002c9c3104007b77ae35a1fb0c9f6b97c3a2ea4a68ffec54e4f5c790b96be545
-
SSDEEP
1536:RDMlTeYledR2IQ8hS/3Ie/Ipl2vkMGCVBRcqE+r1MyDAcAz7YCNtm62pUC5KxhD4:RD4T1LIQ4pl2vkCVw7XsAtc2tVsUT+
Static task
static1
Behavioral task
behavioral1
Sample
c312fbc89e1f08c0e37d4cd2ac4c2190890d3735c7f8c0a2995606e42fd3edb9.exe
Resource
win7-20220812-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
c312fbc89e1f08c0e37d4cd2ac4c2190890d3735c7f8c0a2995606e42fd3edb9
-
Size
100KB
-
MD5
1461d59c12655be3ea1fc75252877d61
-
SHA1
b8c00950ee048ee0dab9c364b51916681ec64171
-
SHA256
c312fbc89e1f08c0e37d4cd2ac4c2190890d3735c7f8c0a2995606e42fd3edb9
-
SHA512
341921e91762615f76cc0f2ac4d1a5032ab2b224ab7ee06894811e8747566bdd002c9c3104007b77ae35a1fb0c9f6b97c3a2ea4a68ffec54e4f5c790b96be545
-
SSDEEP
1536:RDMlTeYledR2IQ8hS/3Ie/Ipl2vkMGCVBRcqE+r1MyDAcAz7YCNtm62pUC5KxhD4:RD4T1LIQ4pl2vkCVw7XsAtc2tVsUT+
-
Modifies firewall policy service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-