General
-
Target
02084f8451a04b784001637f0d1b1691bcc050ea28a407a79fe215473c0cfbecN.exe
-
Size
120KB
-
Sample
250108-jabmsaskhp
-
MD5
c2659b93bb2a2949926f76a7b927d0e0
-
SHA1
ae26ffdeae0323cef95214b1fea0dacfa679f098
-
SHA256
02084f8451a04b784001637f0d1b1691bcc050ea28a407a79fe215473c0cfbec
-
SHA512
da4ca8b6d08a65be8c6b40c2895e2993420a7dff137ba5ee51dcfb5ff5c701423786ccb58d3e5ceda7de0f5de958a1002399ead2cb70b940d634bcccb75b2920
-
SSDEEP
1536:eIG/ndqWqk90JLLkBJD8cOI18xPVFPhwz/2Ib5eQMMpWwj3q6lJwQr2w:eIeqfCJDj8xP/yL2Ib5btpWgRPwax
Static task
static1
Behavioral task
behavioral1
Sample
02084f8451a04b784001637f0d1b1691bcc050ea28a407a79fe215473c0cfbecN.dll
Resource
win7-20240903-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
02084f8451a04b784001637f0d1b1691bcc050ea28a407a79fe215473c0cfbecN.exe
-
Size
120KB
-
MD5
c2659b93bb2a2949926f76a7b927d0e0
-
SHA1
ae26ffdeae0323cef95214b1fea0dacfa679f098
-
SHA256
02084f8451a04b784001637f0d1b1691bcc050ea28a407a79fe215473c0cfbec
-
SHA512
da4ca8b6d08a65be8c6b40c2895e2993420a7dff137ba5ee51dcfb5ff5c701423786ccb58d3e5ceda7de0f5de958a1002399ead2cb70b940d634bcccb75b2920
-
SSDEEP
1536:eIG/ndqWqk90JLLkBJD8cOI18xPVFPhwz/2Ib5eQMMpWwj3q6lJwQr2w:eIeqfCJDj8xP/yL2Ib5btpWgRPwax
-
Modifies firewall policy service
-
Sality family
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5