General

  • Target

    c408c71be1f4c3cc0f41edd4edfe9b72fe8760579123de4f553090a7cdbad322N.exe

  • Size

    120KB

  • Sample

    241219-gzepmasqdn

  • MD5

    9eb6d978e4c1d79b6b84899f37f0f950

  • SHA1

    04ccfaead5a96c6c5e3dd2889cb8b178851a8f30

  • SHA256

    c408c71be1f4c3cc0f41edd4edfe9b72fe8760579123de4f553090a7cdbad322

  • SHA512

    0880fa1683c9b3ebb928d21e66fd06371607785acab76f2844e73b5a4de0a1e0fabee8a1847ebcbf439bb0b78ddbeeb9da80d35d9bafcf5cb071d3cf15da62bd

  • SSDEEP

    1536:E0O6HgE563cIYzfa1ZR7uvM3dBDUMmLs65xDhiqYXMTg8/mNlGs5U6NlUTDJF:nO6Ai6PZbdBg665xDUcF/mrR5jN6JF

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      c408c71be1f4c3cc0f41edd4edfe9b72fe8760579123de4f553090a7cdbad322N.exe

    • Size

      120KB

    • MD5

      9eb6d978e4c1d79b6b84899f37f0f950

    • SHA1

      04ccfaead5a96c6c5e3dd2889cb8b178851a8f30

    • SHA256

      c408c71be1f4c3cc0f41edd4edfe9b72fe8760579123de4f553090a7cdbad322

    • SHA512

      0880fa1683c9b3ebb928d21e66fd06371607785acab76f2844e73b5a4de0a1e0fabee8a1847ebcbf439bb0b78ddbeeb9da80d35d9bafcf5cb071d3cf15da62bd

    • SSDEEP

      1536:E0O6HgE563cIYzfa1ZR7uvM3dBDUMmLs65xDhiqYXMTg8/mNlGs5U6NlUTDJF:nO6Ai6PZbdBg665xDUcF/mrR5jN6JF

    • Modifies firewall policy service

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • Sality family

    • UAC bypass

    • Windows security bypass

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks