General

  • Target

    46056e31bc09f462790305fb107e96beaf81e8cd24995090e90c329076fa8054.exe

  • Size

    120KB

  • Sample

    241222-qzmvnszrgp

  • MD5

    65cc4c86901e53f1b29467938dede4be

  • SHA1

    5800faf42650109eafba08bd2737d90b4eb09cd3

  • SHA256

    46056e31bc09f462790305fb107e96beaf81e8cd24995090e90c329076fa8054

  • SHA512

    4a5546deac4d2646b49fa02d56e1ceaa9e6ede7b03d89ee6d8aed5f1be272ea3797364b3b83357d6cadde8b34a20362a9dced88db1a40dacf22b5b8d1ef0c1f5

  • SSDEEP

    3072:CRgvSQ2LaQAE7m020Vf1G2DQYa5esWtnW:KgvF2yEK020VfYe3tnW

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      46056e31bc09f462790305fb107e96beaf81e8cd24995090e90c329076fa8054.exe

    • Size

      120KB

    • MD5

      65cc4c86901e53f1b29467938dede4be

    • SHA1

      5800faf42650109eafba08bd2737d90b4eb09cd3

    • SHA256

      46056e31bc09f462790305fb107e96beaf81e8cd24995090e90c329076fa8054

    • SHA512

      4a5546deac4d2646b49fa02d56e1ceaa9e6ede7b03d89ee6d8aed5f1be272ea3797364b3b83357d6cadde8b34a20362a9dced88db1a40dacf22b5b8d1ef0c1f5

    • SSDEEP

      3072:CRgvSQ2LaQAE7m020Vf1G2DQYa5esWtnW:KgvF2yEK020VfYe3tnW

    • Modifies firewall policy service

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • Sality family

    • UAC bypass

    • Windows security bypass

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks