General
-
Target
Backup.exe
-
Size
148KB
-
Sample
240229-tc9ygadf7y
-
MD5
8d3cd6f905b61f3f7dba14e4a1ef46e8
-
SHA1
5640b4a7a04f2f2abe197c3d6ec2a3f9d015c732
-
SHA256
d1750f0b6705f1b33c84e48ef44155ee223c8cdfb1cca180bc1d118907ad4af5
-
SHA512
369b48eeab49c7871603b19b91341296c69abe4636c39931bbf29b6fbff7a5bfed8fb637288db786dd471501a58440e8746237a2d1de1bb871d9a80b8c7617e0
-
SSDEEP
3072:+uk0QpFZyOSAYZRx6iDrhLOUppeiSQQ1FdXtuyIGFajyxwKZ:+uk0lrTrHSQQ1FJtuNAajyPZ
Static task
static1
Behavioral task
behavioral1
Sample
Backup.exe
Resource
win7-20240221-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
Backup.exe
-
Size
148KB
-
MD5
8d3cd6f905b61f3f7dba14e4a1ef46e8
-
SHA1
5640b4a7a04f2f2abe197c3d6ec2a3f9d015c732
-
SHA256
d1750f0b6705f1b33c84e48ef44155ee223c8cdfb1cca180bc1d118907ad4af5
-
SHA512
369b48eeab49c7871603b19b91341296c69abe4636c39931bbf29b6fbff7a5bfed8fb637288db786dd471501a58440e8746237a2d1de1bb871d9a80b8c7617e0
-
SSDEEP
3072:+uk0QpFZyOSAYZRx6iDrhLOUppeiSQQ1FdXtuyIGFajyxwKZ:+uk0lrTrHSQQ1FJtuNAajyPZ
-
Modifies firewall policy service
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1