General
-
Target
9af3a7ecb32e7e06c7e5faab827284e36581fb647d678d1154769e300432f0a8N.exe
-
Size
65KB
-
Sample
241219-3n27fatncn
-
MD5
6d4410846a889f2aaa5b94519d47fdf0
-
SHA1
f7b04d775934bf1161929f18f0573d9d997719cf
-
SHA256
9af3a7ecb32e7e06c7e5faab827284e36581fb647d678d1154769e300432f0a8
-
SHA512
dc444dbe5f19d03f855f600682d3171ab61c706d2d131740187f2906f95968dddc5508bb274c7a5f5674cda8fad83b68e5293af4a18cb9fae912de1c4538a4c3
-
SSDEEP
1536:I5ww9IbIaZ7ddEdfsR9XGC+N0raO1vU1fvXRZEadHHpWFUZsRgcWDG3mFZ:I5P9ZaFEdcGHN0amaYadnOSvGWZ
Static task
static1
Behavioral task
behavioral1
Sample
9af3a7ecb32e7e06c7e5faab827284e36581fb647d678d1154769e300432f0a8N.exe
Resource
win7-20241010-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
9af3a7ecb32e7e06c7e5faab827284e36581fb647d678d1154769e300432f0a8N.exe
-
Size
65KB
-
MD5
6d4410846a889f2aaa5b94519d47fdf0
-
SHA1
f7b04d775934bf1161929f18f0573d9d997719cf
-
SHA256
9af3a7ecb32e7e06c7e5faab827284e36581fb647d678d1154769e300432f0a8
-
SHA512
dc444dbe5f19d03f855f600682d3171ab61c706d2d131740187f2906f95968dddc5508bb274c7a5f5674cda8fad83b68e5293af4a18cb9fae912de1c4538a4c3
-
SSDEEP
1536:I5ww9IbIaZ7ddEdfsR9XGC+N0raO1vU1fvXRZEadHHpWFUZsRgcWDG3mFZ:I5P9ZaFEdcGHN0amaYadnOSvGWZ
-
Modifies firewall policy service
-
Sality family
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5