General

  • Target

    JaffaCakes118_09c63e32ab7539bec94e30e1ce6ca0c0

  • Size

    196KB

  • Sample

    241231-hsxsaszmel

  • MD5

    09c63e32ab7539bec94e30e1ce6ca0c0

  • SHA1

    383cf60b6d2b4cb736a6596f8f9b7e18e2e41d44

  • SHA256

    339370c452b23163878bddd5bb8a375a20730d5a4c9c0c2a8f59b037672714ac

  • SHA512

    a30926c75563b467bd9ab35af80a587eb9d17e15b64b5c617c7450e39ac3508e27f4f024851328ee6410da5e7d1ffce2b4706e7731351bfd921f029d42abffcb

  • SSDEEP

    3072:3axyeSRyAslbKmB1UetP+O9yPtwy2nRcC08d2RfU3ARoLl9KI:KAecy7lQ4+3PtwCc3tB

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      JaffaCakes118_09c63e32ab7539bec94e30e1ce6ca0c0

    • Size

      196KB

    • MD5

      09c63e32ab7539bec94e30e1ce6ca0c0

    • SHA1

      383cf60b6d2b4cb736a6596f8f9b7e18e2e41d44

    • SHA256

      339370c452b23163878bddd5bb8a375a20730d5a4c9c0c2a8f59b037672714ac

    • SHA512

      a30926c75563b467bd9ab35af80a587eb9d17e15b64b5c617c7450e39ac3508e27f4f024851328ee6410da5e7d1ffce2b4706e7731351bfd921f029d42abffcb

    • SSDEEP

      3072:3axyeSRyAslbKmB1UetP+O9yPtwy2nRcC08d2RfU3ARoLl9KI:KAecy7lQ4+3PtwCc3tB

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • Sality family

    • Windows security bypass

    • Windows security modification

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks