General
-
Target
eeeaafb4640cbb1536e7f446bac3d938d720b07e80157d72ad7ca4bc4cce64b8
-
Size
120KB
-
Sample
240529-ee82mahe51
-
MD5
95d04a4981aaee982d5e59d3e28b17f8
-
SHA1
236e39073d2ba5a27e180d1264a88e29c8386c4e
-
SHA256
eeeaafb4640cbb1536e7f446bac3d938d720b07e80157d72ad7ca4bc4cce64b8
-
SHA512
0b9a231207f31205d5447fb50cbc21462da5cd3a5c9dbd1a668185950ff93dffc7a663ee16cbf451a352cc2f81f19ca718020d344593c4fa804ac7c90f9c7dea
-
SSDEEP
1536:bKdezYtJky738STOBzaFCXtgj3A/Z7qGSo63IVHk/R4+ECI9:bKdeMtz7LTGzaFCXtGQ/oZzYVH629C
Static task
static1
Behavioral task
behavioral1
Sample
eeeaafb4640cbb1536e7f446bac3d938d720b07e80157d72ad7ca4bc4cce64b8.dll
Resource
win7-20240221-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
eeeaafb4640cbb1536e7f446bac3d938d720b07e80157d72ad7ca4bc4cce64b8
-
Size
120KB
-
MD5
95d04a4981aaee982d5e59d3e28b17f8
-
SHA1
236e39073d2ba5a27e180d1264a88e29c8386c4e
-
SHA256
eeeaafb4640cbb1536e7f446bac3d938d720b07e80157d72ad7ca4bc4cce64b8
-
SHA512
0b9a231207f31205d5447fb50cbc21462da5cd3a5c9dbd1a668185950ff93dffc7a663ee16cbf451a352cc2f81f19ca718020d344593c4fa804ac7c90f9c7dea
-
SSDEEP
1536:bKdezYtJky738STOBzaFCXtgj3A/Z7qGSo63IVHk/R4+ECI9:bKdeMtz7LTGzaFCXtGQ/oZzYVH629C
-
Modifies firewall policy service
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5