General
-
Target
00d97c26c0189473006e84804ee32aa4ee495de7cad23cad96f9f2d9041ef967
-
Size
246KB
-
Sample
241217-xv663swmep
-
MD5
4708d9b92c303a0f05b29e17de3bda41
-
SHA1
1208d71822b755a55449ce9fc6d9b5f39d7f7413
-
SHA256
00d97c26c0189473006e84804ee32aa4ee495de7cad23cad96f9f2d9041ef967
-
SHA512
9e3d2d975a895521435b0d5f25e63612715af765faef8ea92472c072e8cb94a1be85dbc44e1b200bfb6f8b996b5ccacfcf46a50eb8e6e1b3f0d2f374b1c97256
-
SSDEEP
6144:o7JwviC441gYIt5ApFo+mK8lAAs4FvfAVmF:o7yKZEyqFrWAk4VW
Static task
static1
Behavioral task
behavioral1
Sample
00d97c26c0189473006e84804ee32aa4ee495de7cad23cad96f9f2d9041ef967.exe
Resource
win7-20240729-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
00d97c26c0189473006e84804ee32aa4ee495de7cad23cad96f9f2d9041ef967
-
Size
246KB
-
MD5
4708d9b92c303a0f05b29e17de3bda41
-
SHA1
1208d71822b755a55449ce9fc6d9b5f39d7f7413
-
SHA256
00d97c26c0189473006e84804ee32aa4ee495de7cad23cad96f9f2d9041ef967
-
SHA512
9e3d2d975a895521435b0d5f25e63612715af765faef8ea92472c072e8cb94a1be85dbc44e1b200bfb6f8b996b5ccacfcf46a50eb8e6e1b3f0d2f374b1c97256
-
SSDEEP
6144:o7JwviC441gYIt5ApFo+mK8lAAs4FvfAVmF:o7yKZEyqFrWAk4VW
-
Modifies firewall policy service
-
Sality family
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5