General

  • Target

    436b0655bc4f944529ae2e0285d12d2ff6c360030926185da6227a36251a0b5f.exe

  • Size

    120KB

  • Sample

    241218-a3lh1svmfw

  • MD5

    32733b923780ffe49fdd41704bfe8de6

  • SHA1

    5a7bca71f8bd649c87539f8271dc54ea0c897289

  • SHA256

    436b0655bc4f944529ae2e0285d12d2ff6c360030926185da6227a36251a0b5f

  • SHA512

    d85c66784e0a2011ae5553491ffe886fff1822f0430e7a520981ade55d408e014e39bcb0bdd9b6c3e4ee3fa7245d2090e9b6323b4b520f5b5a5598e1b55a3270

  • SSDEEP

    3072:2vpALNdy5WfswwJqeE0V9Fc0K1cDXW4CbOiqt:8pONkUsjzxnKaXW4OOnt

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      436b0655bc4f944529ae2e0285d12d2ff6c360030926185da6227a36251a0b5f.exe

    • Size

      120KB

    • MD5

      32733b923780ffe49fdd41704bfe8de6

    • SHA1

      5a7bca71f8bd649c87539f8271dc54ea0c897289

    • SHA256

      436b0655bc4f944529ae2e0285d12d2ff6c360030926185da6227a36251a0b5f

    • SHA512

      d85c66784e0a2011ae5553491ffe886fff1822f0430e7a520981ade55d408e014e39bcb0bdd9b6c3e4ee3fa7245d2090e9b6323b4b520f5b5a5598e1b55a3270

    • SSDEEP

      3072:2vpALNdy5WfswwJqeE0V9Fc0K1cDXW4CbOiqt:8pONkUsjzxnKaXW4OOnt

    • Modifies firewall policy service

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • Sality family

    • UAC bypass

    • Windows security bypass

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks