General
-
Target
b4f157404b1734654e67bf5c46f9b1d20651264ff193b6bb1355ed8bb6e5ee02
-
Size
1.7MB
-
Sample
241219-cvsngasqfv
-
MD5
6866c51e81a289b054be5cbb77dd1b1d
-
SHA1
4b1c9f90bbd321523c66392eef741eed9063befa
-
SHA256
b4f157404b1734654e67bf5c46f9b1d20651264ff193b6bb1355ed8bb6e5ee02
-
SHA512
db6152ad0e12f1cbe6506ea1e111657ed5c6c8c459b121581a49aa6adad7c8b840212f3074ff416b6dd15fb59d9e4b8e4caafeb61127d8300db25568957c7587
-
SSDEEP
49152:Au0LSVHASxN9aD7sOP93ZPaZRNsa95ZN5f:n0mVgSxa872av5
Static task
static1
Behavioral task
behavioral1
Sample
b4f157404b1734654e67bf5c46f9b1d20651264ff193b6bb1355ed8bb6e5ee02.exe
Resource
win7-20241023-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
b4f157404b1734654e67bf5c46f9b1d20651264ff193b6bb1355ed8bb6e5ee02
-
Size
1.7MB
-
MD5
6866c51e81a289b054be5cbb77dd1b1d
-
SHA1
4b1c9f90bbd321523c66392eef741eed9063befa
-
SHA256
b4f157404b1734654e67bf5c46f9b1d20651264ff193b6bb1355ed8bb6e5ee02
-
SHA512
db6152ad0e12f1cbe6506ea1e111657ed5c6c8c459b121581a49aa6adad7c8b840212f3074ff416b6dd15fb59d9e4b8e4caafeb61127d8300db25568957c7587
-
SSDEEP
49152:Au0LSVHASxN9aD7sOP93ZPaZRNsa95ZN5f:n0mVgSxa872av5
-
Modifies firewall policy service
-
Sality family
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6