General
-
Target
2e2b9fb582617033ebd83df1855077328dfd21d68b47d8b3ec4931a5bf9c71a0.exe
-
Size
120KB
-
Sample
241222-esn9datjhl
-
MD5
cd958efa21adbf8562161ab4b551a116
-
SHA1
94a2eb6970d718c985eb1d2a202ea8db4f380c0d
-
SHA256
2e2b9fb582617033ebd83df1855077328dfd21d68b47d8b3ec4931a5bf9c71a0
-
SHA512
7c59f861b00815bb90aabc4204bde0c6d92c4e2ead0b7412fb1218f5c3df8e27a42470230fabb10937bd549ddde7f233b66a2deb42055bfe0f91974f9531a923
-
SSDEEP
3072:9VIgjMrGSI6KVTRyTSML/dGyQfC4g/Abm:gbGSjKVTRySMLJQf1gwm
Static task
static1
Behavioral task
behavioral1
Sample
2e2b9fb582617033ebd83df1855077328dfd21d68b47d8b3ec4931a5bf9c71a0.dll
Resource
win7-20240729-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
2e2b9fb582617033ebd83df1855077328dfd21d68b47d8b3ec4931a5bf9c71a0.exe
-
Size
120KB
-
MD5
cd958efa21adbf8562161ab4b551a116
-
SHA1
94a2eb6970d718c985eb1d2a202ea8db4f380c0d
-
SHA256
2e2b9fb582617033ebd83df1855077328dfd21d68b47d8b3ec4931a5bf9c71a0
-
SHA512
7c59f861b00815bb90aabc4204bde0c6d92c4e2ead0b7412fb1218f5c3df8e27a42470230fabb10937bd549ddde7f233b66a2deb42055bfe0f91974f9531a923
-
SSDEEP
3072:9VIgjMrGSI6KVTRyTSML/dGyQfC4g/Abm:gbGSjKVTRySMLJQf1gwm
-
Modifies firewall policy service
-
Sality family
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5