General
-
Target
77435dd40d7958451986fd967e883cfcec6e60a53e5ed61b871887b8ccf9d1cf
-
Size
2.3MB
-
Sample
241217-3ddfbstmcl
-
MD5
a2c9346724c49126940e5a6ef55e0b02
-
SHA1
d906af9d21e28d9432456e92e090063504277477
-
SHA256
77435dd40d7958451986fd967e883cfcec6e60a53e5ed61b871887b8ccf9d1cf
-
SHA512
737f573b40c50694c566680b1544c14b603cf4fe816cd6734f6ca754f58f37bdd79befd197af63fb4cf673cec3cadbf91f96fdb266946bae9892a06ff1739567
-
SSDEEP
49152:2Parn/x9Pwrn/POzMQGEvGH7DtN1dwQXalyJ3ns+Parn/x9Pwrn/POzMQGEvGH7k:brn/x9Pwrn/POzMQGEutNjwkaERszrnl
Static task
static1
Behavioral task
behavioral1
Sample
77435dd40d7958451986fd967e883cfcec6e60a53e5ed61b871887b8ccf9d1cf.exe
Resource
win7-20241023-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
77435dd40d7958451986fd967e883cfcec6e60a53e5ed61b871887b8ccf9d1cf
-
Size
2.3MB
-
MD5
a2c9346724c49126940e5a6ef55e0b02
-
SHA1
d906af9d21e28d9432456e92e090063504277477
-
SHA256
77435dd40d7958451986fd967e883cfcec6e60a53e5ed61b871887b8ccf9d1cf
-
SHA512
737f573b40c50694c566680b1544c14b603cf4fe816cd6734f6ca754f58f37bdd79befd197af63fb4cf673cec3cadbf91f96fdb266946bae9892a06ff1739567
-
SSDEEP
49152:2Parn/x9Pwrn/POzMQGEvGH7DtN1dwQXalyJ3ns+Parn/x9Pwrn/POzMQGEvGH7k:brn/x9Pwrn/POzMQGEutNjwkaERszrnl
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Sality family
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Pre-OS Boot
1Bootkit
1