General

  • Target

    0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118

  • Size

    255KB

  • Sample

    240625-pha9wasdlk

  • MD5

    0e0b392d511d9c14d51fff720b3f3d9e

  • SHA1

    a7e78a574012637e6c300dba2f482a94e6ecfb65

  • SHA256

    c774f3dca844e6fc31b1b23328fcc10860f30d2fccab118bea20d601779ae112

  • SHA512

    d003310d9ece75978b4c18f5f735da935db4411df3898a6d2df0289260780d1116347ebd186951d052fd25b18e61bf4c50777d8e559584651cff210932a4cbad

  • SSDEEP

    3072:HunxwgxgfR/DVG7wBpErzWRVoYc0WnqAdelWGPRSOLjK+ca1x:G+xDVG0BpE+lAvepSOLjAMx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

http://klkjwre77638dfqwieuoi888.info/

Targets

    • Target

      0e0b392d511d9c14d51fff720b3f3d9e_JaffaCakes118

    • Size

      255KB

    • MD5

      0e0b392d511d9c14d51fff720b3f3d9e

    • SHA1

      a7e78a574012637e6c300dba2f482a94e6ecfb65

    • SHA256

      c774f3dca844e6fc31b1b23328fcc10860f30d2fccab118bea20d601779ae112

    • SHA512

      d003310d9ece75978b4c18f5f735da935db4411df3898a6d2df0289260780d1116347ebd186951d052fd25b18e61bf4c50777d8e559584651cff210932a4cbad

    • SSDEEP

      3072:HunxwgxgfR/DVG7wBpErzWRVoYc0WnqAdelWGPRSOLjK+ca1x:G+xDVG0BpE+lAvepSOLjAMx

    • Modifies WinLogon for persistence

    • Modifies firewall policy service

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • UAC bypass

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Checks whether UAC is enabled

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks