General
-
Target
ed62495f5053e3081ead9b835c23120acfb0eca81b74814c64f735a2bf04e7e4
-
Size
65KB
-
Sample
240423-f3zzasdf52
-
MD5
6574be702b35ed9ce11abde01910bec5
-
SHA1
6c7e51f528f8a512a8487992e875f37d8cc3cfc0
-
SHA256
ed62495f5053e3081ead9b835c23120acfb0eca81b74814c64f735a2bf04e7e4
-
SHA512
ca97a8b2ee46134266f0a35dc28987db9dd44c6a44a38541d943eaa33c2199c5096c71e6062a43273e448614b1f7f961bbc23cc1546d69f48a4154fa95e1b313
-
SSDEEP
1536:RTzalRjcUmLlepJqP/fteCrljQh4WnqPHNlxZEqIDmXs1:RH04epJqXftnrChFnqxZEqIqXs1
Static task
static1
Behavioral task
behavioral1
Sample
ed62495f5053e3081ead9b835c23120acfb0eca81b74814c64f735a2bf04e7e4.exe
Resource
win7-20240221-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
ed62495f5053e3081ead9b835c23120acfb0eca81b74814c64f735a2bf04e7e4
-
Size
65KB
-
MD5
6574be702b35ed9ce11abde01910bec5
-
SHA1
6c7e51f528f8a512a8487992e875f37d8cc3cfc0
-
SHA256
ed62495f5053e3081ead9b835c23120acfb0eca81b74814c64f735a2bf04e7e4
-
SHA512
ca97a8b2ee46134266f0a35dc28987db9dd44c6a44a38541d943eaa33c2199c5096c71e6062a43273e448614b1f7f961bbc23cc1546d69f48a4154fa95e1b313
-
SSDEEP
1536:RTzalRjcUmLlepJqP/fteCrljQh4WnqPHNlxZEqIDmXs1:RH04epJqXftnrChFnqxZEqIqXs1
-
Modifies firewall policy service
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
-
UPX dump on OEP (original entry point)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3