General

  • Target

    a7b25dad44e97f4075655861d2044730dfd70cd6f9ee8eac0ab8e250429d1d66N.exe

  • Size

    65KB

  • Sample

    241219-axv59synhv

  • MD5

    181e2428566d5246b36a4a6a3a99c930

  • SHA1

    67ccbcd84723cda0bbc074970671e55afa4bb7fd

  • SHA256

    a7b25dad44e97f4075655861d2044730dfd70cd6f9ee8eac0ab8e250429d1d66

  • SHA512

    5d48587b16088602cc4f0d427613ee75ff2748ae8bb282273ed6e2d526d1ad9d82b811017c7db98cb195f928bc5cfbe319041a24439ffc956e93c289c602ae26

  • SSDEEP

    1536:ZkQsKASkj8kpeWeG9Mv1Culqjw/KL6ytdh2LmBVXMZwkFPixXLggJR:ZktpnteWtMvYEqc/AdRQeRUPiEk

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      a7b25dad44e97f4075655861d2044730dfd70cd6f9ee8eac0ab8e250429d1d66N.exe

    • Size

      65KB

    • MD5

      181e2428566d5246b36a4a6a3a99c930

    • SHA1

      67ccbcd84723cda0bbc074970671e55afa4bb7fd

    • SHA256

      a7b25dad44e97f4075655861d2044730dfd70cd6f9ee8eac0ab8e250429d1d66

    • SHA512

      5d48587b16088602cc4f0d427613ee75ff2748ae8bb282273ed6e2d526d1ad9d82b811017c7db98cb195f928bc5cfbe319041a24439ffc956e93c289c602ae26

    • SSDEEP

      1536:ZkQsKASkj8kpeWeG9Mv1Culqjw/KL6ytdh2LmBVXMZwkFPixXLggJR:ZktpnteWtMvYEqc/AdRQeRUPiEk

    • Modifies firewall policy service

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • Sality family

    • UAC bypass

    • Windows security bypass

    • Windows security modification

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.