General

  • Target

    616cc1083db71df7934894fe9747382d_JaffaCakes118

  • Size

    169KB

  • Sample

    240721-z3n2ksxdjn

  • MD5

    616cc1083db71df7934894fe9747382d

  • SHA1

    919b96f81cc7aba6204bc2749b3e97afa56d6204

  • SHA256

    e413122ddf8ab5ccee6e2448192a53ff7fee9c3bbf26e05a1713f0189942d942

  • SHA512

    38e5d4c82ee72bff22afd6e609d95a4d233746eba4049b1fdb2be276c653c69dc84fc9ed11498d8d964aea0456fc3ea77dec4e5f30daae5014b526f0fdede52c

  • SSDEEP

    3072:STAH9yRHHhrTz9R4BdOkqp/ZqW2L6ZPE:SznRgBd0/LG

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      616cc1083db71df7934894fe9747382d_JaffaCakes118

    • Size

      169KB

    • MD5

      616cc1083db71df7934894fe9747382d

    • SHA1

      919b96f81cc7aba6204bc2749b3e97afa56d6204

    • SHA256

      e413122ddf8ab5ccee6e2448192a53ff7fee9c3bbf26e05a1713f0189942d942

    • SHA512

      38e5d4c82ee72bff22afd6e609d95a4d233746eba4049b1fdb2be276c653c69dc84fc9ed11498d8d964aea0456fc3ea77dec4e5f30daae5014b526f0fdede52c

    • SSDEEP

      3072:STAH9yRHHhrTz9R4BdOkqp/ZqW2L6ZPE:SznRgBd0/LG

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • UAC bypass

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks