General
-
Target
ab0d5b5a65361bf88bef4f1023f19867db3a0e6eabad1d997035d69e8140e1fe
-
Size
97KB
-
Sample
240519-bkajgaae96
-
MD5
d360870cca54082291525d8c4233e222
-
SHA1
84b3b221701c830dfb3043683596d12ae6926a6f
-
SHA256
ab0d5b5a65361bf88bef4f1023f19867db3a0e6eabad1d997035d69e8140e1fe
-
SHA512
1ef1b5175e955396bca871155b5ef93cc3559aebf46b5209224c8ad611feb762132f735d122b9055d3658d6401973d07a931ab4ee9d256cb87ca77033e9bfe0a
-
SSDEEP
1536:O5tO26FMbSbWaHq16MHRTca30EpCEWtaRGrfw8lRJ:O7OLu/bHRVkEFWtaRGrIq
Static task
static1
Behavioral task
behavioral1
Sample
ab0d5b5a65361bf88bef4f1023f19867db3a0e6eabad1d997035d69e8140e1fe.exe
Resource
win7-20240215-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
ab0d5b5a65361bf88bef4f1023f19867db3a0e6eabad1d997035d69e8140e1fe
-
Size
97KB
-
MD5
d360870cca54082291525d8c4233e222
-
SHA1
84b3b221701c830dfb3043683596d12ae6926a6f
-
SHA256
ab0d5b5a65361bf88bef4f1023f19867db3a0e6eabad1d997035d69e8140e1fe
-
SHA512
1ef1b5175e955396bca871155b5ef93cc3559aebf46b5209224c8ad611feb762132f735d122b9055d3658d6401973d07a931ab4ee9d256cb87ca77033e9bfe0a
-
SSDEEP
1536:O5tO26FMbSbWaHq16MHRTca30EpCEWtaRGrfw8lRJ:O7OLu/bHRVkEFWtaRGrIq
-
Modifies firewall policy service
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
-
UPX dump on OEP (original entry point)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5