General
-
Target
322891dc707488058036c5255dcabefe39527fa93d09c2331d6392d6499efd00.exe
-
Size
100KB
-
Sample
241219-h3bb2strcw
-
MD5
5aeab8e067a7af336f06d44921ee43db
-
SHA1
1c6bfc0f3a6435df8bb62ebbe29a2e65b61a12eb
-
SHA256
322891dc707488058036c5255dcabefe39527fa93d09c2331d6392d6499efd00
-
SHA512
86b531508f39c67336cf27ea31275759b04c7e2650ef882194ee0bb2ae511dd1d37cfbb625ce474f3c216bb1747ec46af2875862c7a7f6325bad7b4bedee9ebe
-
SSDEEP
1536:h6wEd6F5g+1vRZWjJUW/ONgTVHMY6F/HWXxViY/qc1zlHXk/j:h6aP3RZWWW/OgVslF/HWBt1G
Static task
static1
Behavioral task
behavioral1
Sample
322891dc707488058036c5255dcabefe39527fa93d09c2331d6392d6499efd00.exe
Resource
win7-20241010-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
322891dc707488058036c5255dcabefe39527fa93d09c2331d6392d6499efd00.exe
-
Size
100KB
-
MD5
5aeab8e067a7af336f06d44921ee43db
-
SHA1
1c6bfc0f3a6435df8bb62ebbe29a2e65b61a12eb
-
SHA256
322891dc707488058036c5255dcabefe39527fa93d09c2331d6392d6499efd00
-
SHA512
86b531508f39c67336cf27ea31275759b04c7e2650ef882194ee0bb2ae511dd1d37cfbb625ce474f3c216bb1747ec46af2875862c7a7f6325bad7b4bedee9ebe
-
SSDEEP
1536:h6wEd6F5g+1vRZWjJUW/ONgTVHMY6F/HWXxViY/qc1zlHXk/j:h6aP3RZWWW/OgVslF/HWBt1G
-
Modifies firewall policy service
-
Sality family
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5