General

  • Target

    8fb7ff706da66d387cbce9c3321f180d6dfcb524f048cd3abf1c6f4dc7627557

  • Size

    2.1MB

  • Sample

    240220-shl8xsac61

  • MD5

    9e71668d3609f400d1deed045688fdbe

  • SHA1

    5544c32496024ed4c9f0396e078d70469ad6f450

  • SHA256

    8fb7ff706da66d387cbce9c3321f180d6dfcb524f048cd3abf1c6f4dc7627557

  • SHA512

    50517849903bbbabb551e8ebbe547d584cfc33e9b946fb3f3ccb423ca70be4e123400d23b25979e856a13c8a6f68369ddb7c0e3e546c134fcdd98e09a880f997

  • SSDEEP

    24576:L52f3WJAtOP1k5FOo71OG4rfHqELkcebAL2BhXoRFXrZ9T:L52/M0cmzELkcwAL2TYRF

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      8fb7ff706da66d387cbce9c3321f180d6dfcb524f048cd3abf1c6f4dc7627557

    • Size

      2.1MB

    • MD5

      9e71668d3609f400d1deed045688fdbe

    • SHA1

      5544c32496024ed4c9f0396e078d70469ad6f450

    • SHA256

      8fb7ff706da66d387cbce9c3321f180d6dfcb524f048cd3abf1c6f4dc7627557

    • SHA512

      50517849903bbbabb551e8ebbe547d584cfc33e9b946fb3f3ccb423ca70be4e123400d23b25979e856a13c8a6f68369ddb7c0e3e546c134fcdd98e09a880f997

    • SSDEEP

      24576:L52f3WJAtOP1k5FOo71OG4rfHqELkcebAL2BhXoRFXrZ9T:L52/M0cmzELkcwAL2TYRF

    • Modifies firewall policy service

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • UAC bypass

    • Windows security bypass

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks