Malware sandboxing report by Hatching Triage

General

Target

d1b90eda8f53941e0e5eb0ec4ca270b52027b03bea6f312a7647f9f3c39040cc
Size

160KB
Sample

230130-d9lddafh69
MD5

896d561765d793ad98a6e17155d78440
SHA1

ee6c4cd6f39e8d7e32130b13ac832f1cff32e3c3
SHA256

d1b90eda8f53941e0e5eb0ec4ca270b52027b03bea6f312a7647f9f3c39040cc
SHA512

0caefd9a8fe0219f3fe001f3f7c5a135ad4f95de334794dd99ee163f3177f9c7a42939f067d1e9773008af68e63ff240e85cb041040850d8eccadc9e3e4c1f47
SSDEEP

3072:iT2xNfzEmPUac0yCRS9EK0TLmkQzWAJ4IeQkXN5gNAm6Nk:mkPpe0mkQzxJ4IeQC+aE

Score

10^/10

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  d1b90eda8f53941e0e5eb0ec4ca270b52027b03bea6f312a7647f9f3c39040cc
- Size
  
  160KB
- MD5
  
  896d561765d793ad98a6e17155d78440
- SHA1
  
  ee6c4cd6f39e8d7e32130b13ac832f1cff32e3c3
- SHA256
  
  d1b90eda8f53941e0e5eb0ec4ca270b52027b03bea6f312a7647f9f3c39040cc
- SHA512
  
  0caefd9a8fe0219f3fe001f3f7c5a135ad4f95de334794dd99ee163f3177f9c7a42939f067d1e9773008af68e63ff240e85cb041040850d8eccadc9e3e4c1f47
- SSDEEP
  
  3072:iT2xNfzEmPUac0yCRS9EK0TLmkQzWAJ4IeQkXN5gNAm6Nk:mkPpe0mkQzxJ4IeQC+aE
Score

10^/10

ramnit sality backdoor banker evasion persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Deletes itself
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Replication Through Removable Media

Persistence

Privilege Escalation

Bypass User Account Control

Tasks

Sharing

General

Malware Config

Extracted

Targets

Modifies WinLogon for persistence

Modifies firewall policy service

Ramnit

Sality

UAC bypass

Windows security bypass

Executes dropped EXE

UPX packed file

Deletes itself

Loads dropped DLL

Windows security modification

Checks whether UAC is enabled

Enumerates connected drives

Drops autorun.inf file

Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2