General
-
Target
4208cd87d4308030c10a51072c617887a3da5952df5017962d438c8e61bf2e9cN.exe
-
Size
732KB
-
Sample
241218-3r8hmaxlcy
-
MD5
a99decc891d7347345437ff3a99adb50
-
SHA1
048ac3523781bd12a0414c8400efd21dc3f957dd
-
SHA256
4208cd87d4308030c10a51072c617887a3da5952df5017962d438c8e61bf2e9c
-
SHA512
f075d843379c74160cffc83a2184fd191386b72c6f277b29cd5fdfb580db45f918e4a0431f923d49a78514009361630af7d92675a6f28d639406cc95cf767b25
-
SSDEEP
12288:TTyjXW+48qWywrU4kGFezOAVuJ5PIwww7F5DO3HYffwgn4Id:PIXW/8yw1ez54lIGF5SXYHBn4Id
Static task
static1
Behavioral task
behavioral1
Sample
4208cd87d4308030c10a51072c617887a3da5952df5017962d438c8e61bf2e9cN.exe
Resource
win7-20240708-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
4208cd87d4308030c10a51072c617887a3da5952df5017962d438c8e61bf2e9cN.exe
-
Size
732KB
-
MD5
a99decc891d7347345437ff3a99adb50
-
SHA1
048ac3523781bd12a0414c8400efd21dc3f957dd
-
SHA256
4208cd87d4308030c10a51072c617887a3da5952df5017962d438c8e61bf2e9c
-
SHA512
f075d843379c74160cffc83a2184fd191386b72c6f277b29cd5fdfb580db45f918e4a0431f923d49a78514009361630af7d92675a6f28d639406cc95cf767b25
-
SSDEEP
12288:TTyjXW+48qWywrU4kGFezOAVuJ5PIwww7F5DO3HYffwgn4Id:PIXW/8yw1ez54lIGF5SXYHBn4Id
-
Modifies firewall policy service
-
Modifies visibility of file extensions in Explorer
-
Modifies visiblity of hidden/system files in Explorer
-
Sality family
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
8