General
-
Target
66f6dd2ec4828bc19fd0c2a8d5a4cdfea47754c0f17531ac28e496e54276bcbdN
-
Size
120KB
-
Sample
241107-e89v1swble
-
MD5
fc4f4b75ab7ad38b43cdf7da3d2b0ef0
-
SHA1
bc9bfd2c39a636ec1421afc178289e291f5a39cf
-
SHA256
66f6dd2ec4828bc19fd0c2a8d5a4cdfea47754c0f17531ac28e496e54276bcbd
-
SHA512
547ab6eaed2bfe3e874468740256f221809b82a3e9df21f973b0213ef0c9881bb6da37021b684f54fc13d4f441a712a0d513a5231c9e212dfd3bbc1927bda2de
-
SSDEEP
1536:Ly5jbhZEU4N/GESee3vSA4oJTFFUhss8br3xX+O4AmG8d/MkgjYT+:ujbhZEUheRAVJT7UW3xX+jVSYT+
Static task
static1
Behavioral task
behavioral1
Sample
66f6dd2ec4828bc19fd0c2a8d5a4cdfea47754c0f17531ac28e496e54276bcbdN.dll
Resource
win7-20240903-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
66f6dd2ec4828bc19fd0c2a8d5a4cdfea47754c0f17531ac28e496e54276bcbdN
-
Size
120KB
-
MD5
fc4f4b75ab7ad38b43cdf7da3d2b0ef0
-
SHA1
bc9bfd2c39a636ec1421afc178289e291f5a39cf
-
SHA256
66f6dd2ec4828bc19fd0c2a8d5a4cdfea47754c0f17531ac28e496e54276bcbd
-
SHA512
547ab6eaed2bfe3e874468740256f221809b82a3e9df21f973b0213ef0c9881bb6da37021b684f54fc13d4f441a712a0d513a5231c9e212dfd3bbc1927bda2de
-
SSDEEP
1536:Ly5jbhZEU4N/GESee3vSA4oJTFFUhss8br3xX+O4AmG8d/MkgjYT+:ujbhZEUheRAVJT7UW3xX+jVSYT+
-
Modifies firewall policy service
-
Sality family
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5