General

  • Target

    81c51e966e0deed9c1dccd6807dadc42_JaffaCakes118

  • Size

    100KB

  • Sample

    240801-zzad1swflm

  • MD5

    81c51e966e0deed9c1dccd6807dadc42

  • SHA1

    baabc7a06827bb9b829de9c9eca873e66e13354d

  • SHA256

    33aac19829b5d43e12a35f9a0811cb163715f65c949e39629d8605bc9f8911f9

  • SHA512

    5b701798e692451587d01c23daa3bf907ad0cf731f799392d32174d2469341e23c5e85d675aff05649ff9fc077866708bfe2ab7e7dad21e5560c2d78dd2e3ded

  • SSDEEP

    1536:jXSlEFlx8HNUJf0bu+xT1Nl1DYKkrlvcgm9lZuU9SsZmkU6+:jXhFzabhPWKkrlvcgmL8d6+

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      81c51e966e0deed9c1dccd6807dadc42_JaffaCakes118

    • Size

      100KB

    • MD5

      81c51e966e0deed9c1dccd6807dadc42

    • SHA1

      baabc7a06827bb9b829de9c9eca873e66e13354d

    • SHA256

      33aac19829b5d43e12a35f9a0811cb163715f65c949e39629d8605bc9f8911f9

    • SHA512

      5b701798e692451587d01c23daa3bf907ad0cf731f799392d32174d2469341e23c5e85d675aff05649ff9fc077866708bfe2ab7e7dad21e5560c2d78dd2e3ded

    • SSDEEP

      1536:jXSlEFlx8HNUJf0bu+xT1Nl1DYKkrlvcgm9lZuU9SsZmkU6+:jXhFzabhPWKkrlvcgmL8d6+

    • Modifies firewall policy service

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • UAC bypass

    • Windows security bypass

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.