General
-
Target
a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1
-
Size
120KB
-
Sample
241218-dzzs1s1lds
-
MD5
9aa74da878dc993ed35c649926877f2f
-
SHA1
58b633603baf82dbc43383dd4295aa87e7258d41
-
SHA256
a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1
-
SHA512
a8c4683e8116c204ef9b79cdc5049b8c489b488f71fad8adb5303204f935db336f5bae2abc44cdbf8feb077fe8bb4bc79c1cdb8e80e92fb9672e01274709e1fa
-
SSDEEP
1536:ScGQq51NFpraOv4RFq04/4JKsXCflTkUOZ5FFmArOl0R68tc:y51/gzXQ/Q0faJxpB6
Static task
static1
Behavioral task
behavioral1
Sample
a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1.dll
Resource
win7-20240708-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1
-
Size
120KB
-
MD5
9aa74da878dc993ed35c649926877f2f
-
SHA1
58b633603baf82dbc43383dd4295aa87e7258d41
-
SHA256
a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1
-
SHA512
a8c4683e8116c204ef9b79cdc5049b8c489b488f71fad8adb5303204f935db336f5bae2abc44cdbf8feb077fe8bb4bc79c1cdb8e80e92fb9672e01274709e1fa
-
SSDEEP
1536:ScGQq51NFpraOv4RFq04/4JKsXCflTkUOZ5FFmArOl0R68tc:y51/gzXQ/Q0faJxpB6
-
Modifies firewall policy service
-
Sality family
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5