General

  • Target

    1b23a380683b6f37069f8f78bb5d19b1c71690b94df69a994ed979e751b432ba.exe

  • Size

    65KB

  • Sample

    250108-hzwtksyrgs

  • MD5

    1a90db653491416cca8578f71343f8d9

  • SHA1

    c5e1281b6215e803fc604ad44ae1619b7a60c430

  • SHA256

    1b23a380683b6f37069f8f78bb5d19b1c71690b94df69a994ed979e751b432ba

  • SHA512

    06794dece6565a767d9058f44044d07984f6dfd54d8f6348fca0ba9a9795e5f9b713fe2061261878f1abede3384fde2d77aeb3f55babe800d958c15fb7b4d461

  • SSDEEP

    1536:NYi4NIh7RfpQdlKpvOOrq5EduuUEazOa7QrN8Ivd:v4iVwamOrq2dHLazOaeN7vd

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      1b23a380683b6f37069f8f78bb5d19b1c71690b94df69a994ed979e751b432ba.exe

    • Size

      65KB

    • MD5

      1a90db653491416cca8578f71343f8d9

    • SHA1

      c5e1281b6215e803fc604ad44ae1619b7a60c430

    • SHA256

      1b23a380683b6f37069f8f78bb5d19b1c71690b94df69a994ed979e751b432ba

    • SHA512

      06794dece6565a767d9058f44044d07984f6dfd54d8f6348fca0ba9a9795e5f9b713fe2061261878f1abede3384fde2d77aeb3f55babe800d958c15fb7b4d461

    • SSDEEP

      1536:NYi4NIh7RfpQdlKpvOOrq5EduuUEazOa7QrN8Ivd:v4iVwamOrq2dHLazOaeN7vd

    • Modifies firewall policy service

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • Sality family

    • UAC bypass

    • Windows security bypass

    • Windows security modification

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks