General
-
Target
aeca71a10078316edb5388060c90b3e17e77abd5e903beb6033f1cc0bfb84396
-
Size
120KB
-
Sample
240330-15s9ragd95
-
MD5
f82fc4d5bd9121b1968626ad93170e9f
-
SHA1
735922319758e5edd836e10cd5e8b27c703f5d47
-
SHA256
aeca71a10078316edb5388060c90b3e17e77abd5e903beb6033f1cc0bfb84396
-
SHA512
6f6fc9a6c602ca2a7c521b0c3b84919f37ce95a3a8f2ac58f4f5111cafff9b1bfd48f20e8f8838ac2c795b791ad062c76a90249aff0bd3de4c5be85c065d5711
-
SSDEEP
3072:DrLhOcs/XPkLLgZzYjkdlAZXk/BTZhxm5:DrLQcsfPm6HAZX4NLxm5
Static task
static1
Behavioral task
behavioral1
Sample
aeca71a10078316edb5388060c90b3e17e77abd5e903beb6033f1cc0bfb84396.dll
Resource
win7-20240221-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
aeca71a10078316edb5388060c90b3e17e77abd5e903beb6033f1cc0bfb84396
-
Size
120KB
-
MD5
f82fc4d5bd9121b1968626ad93170e9f
-
SHA1
735922319758e5edd836e10cd5e8b27c703f5d47
-
SHA256
aeca71a10078316edb5388060c90b3e17e77abd5e903beb6033f1cc0bfb84396
-
SHA512
6f6fc9a6c602ca2a7c521b0c3b84919f37ce95a3a8f2ac58f4f5111cafff9b1bfd48f20e8f8838ac2c795b791ad062c76a90249aff0bd3de4c5be85c065d5711
-
SSDEEP
3072:DrLhOcs/XPkLLgZzYjkdlAZXk/BTZhxm5:DrLQcsfPm6HAZX4NLxm5
-
Modifies firewall policy service
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5