General
-
Target
fd6d55f14ae71f3b2f82b2b6ed0e29a1d90183661755725bdaedc13cfdbf76a6
-
Size
65KB
-
Sample
240520-fh28xsce65
-
MD5
2d260bba051a6e90917d5eae18b85f9a
-
SHA1
c08bf07baaf8245745c76896dac34ef04b13d82b
-
SHA256
fd6d55f14ae71f3b2f82b2b6ed0e29a1d90183661755725bdaedc13cfdbf76a6
-
SHA512
a41760b94dba5f2664527099b30038bf55a61eae6a6f9d8741852501c65c886c0c074e10bf7814b9c25096a3d0356eb51f0a9a4512e90dbc12a00595880e8a3d
-
SSDEEP
1536:bdt8ggDMs9pOONlOFN2t+Fr0f4iEc3wYOKpMo/ph7EFmIbH:bR+MqlNG4+FrO7AYO2pdEFmIbH
Static task
static1
Behavioral task
behavioral1
Sample
fd6d55f14ae71f3b2f82b2b6ed0e29a1d90183661755725bdaedc13cfdbf76a6.exe
Resource
win7-20240221-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
fd6d55f14ae71f3b2f82b2b6ed0e29a1d90183661755725bdaedc13cfdbf76a6
-
Size
65KB
-
MD5
2d260bba051a6e90917d5eae18b85f9a
-
SHA1
c08bf07baaf8245745c76896dac34ef04b13d82b
-
SHA256
fd6d55f14ae71f3b2f82b2b6ed0e29a1d90183661755725bdaedc13cfdbf76a6
-
SHA512
a41760b94dba5f2664527099b30038bf55a61eae6a6f9d8741852501c65c886c0c074e10bf7814b9c25096a3d0356eb51f0a9a4512e90dbc12a00595880e8a3d
-
SSDEEP
1536:bdt8ggDMs9pOONlOFN2t+Fr0f4iEc3wYOKpMo/ph7EFmIbH:bR+MqlNG4+FrO7AYO2pdEFmIbH
-
Modifies firewall policy service
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
-
UPX dump on OEP (original entry point)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3