General
-
Target
bd430b7202501bb717de216735f9f4ee6ad95457b388ae24046eb8186f1c9568
-
Size
292KB
-
Sample
240330-a823yseb23
-
MD5
71849dbf584ce55ae3c22785deab0140
-
SHA1
0c1625163f6c21b0557c579d1d89c31d697aa7f7
-
SHA256
bd430b7202501bb717de216735f9f4ee6ad95457b388ae24046eb8186f1c9568
-
SHA512
d976e515c7d1c8494715504b16c5680990a3366f90dd3254c03a694a9ae57a3ee381437c8f122163f00a94ca30c2458f707416d820195ee43ba80c2e7184f019
-
SSDEEP
6144:0vEF2U+T6i5LirrllHy4HUcMQY6NdgykIduVr/GASXET7:mEFN+T5xYrllrU7QY6NLkIo6A97
Static task
static1
Behavioral task
behavioral1
Sample
bd430b7202501bb717de216735f9f4ee6ad95457b388ae24046eb8186f1c9568.exe
Resource
win7-20240221-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
bd430b7202501bb717de216735f9f4ee6ad95457b388ae24046eb8186f1c9568
-
Size
292KB
-
MD5
71849dbf584ce55ae3c22785deab0140
-
SHA1
0c1625163f6c21b0557c579d1d89c31d697aa7f7
-
SHA256
bd430b7202501bb717de216735f9f4ee6ad95457b388ae24046eb8186f1c9568
-
SHA512
d976e515c7d1c8494715504b16c5680990a3366f90dd3254c03a694a9ae57a3ee381437c8f122163f00a94ca30c2458f707416d820195ee43ba80c2e7184f019
-
SSDEEP
6144:0vEF2U+T6i5LirrllHy4HUcMQY6NdgykIduVr/GASXET7:mEFN+T5xYrllrU7QY6NLkIo6A97
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies visiblity of hidden/system files in Explorer
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
-
UPX dump on OEP (original entry point)
-
Modifies Installed Components in the registry
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
9Hide Artifacts
1Hidden Files and Directories
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3