Overview

overview

10

Static

static

1

RNSM00262.7z

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    RNSM00262.7z
  • Size 23.5MB
  • Sample250227-2f7xaaspy6
  • SHA256 de0bf2df04a896629563c8142a4a3916ee98a445c954da5da7c6752aa9ed78ca
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
blackshadessalitysendsafeunregisteredbackdoorbotnetdefense_evasiondiscoverypersistenceratspamtrojanupx

Malware Config

Extracted

Language

  • hta

Source
URLs
  • hta.dropper

    http://fyreport.com/inst.php?id=skytraf01

Extracted

Language

  • hta

Source
URLs
  • hta.dropper

    http://report22new.com/inst.php?id=t_a_d_01

Extracted

Language

  • hta

Source
URLs
  • hta.dropper

    http://reportandwin.com/inst.php?id=abs_15

Extracted

Family

  • sendsafe

Botnet

  • UNREGISTERED

C2

  • 91.220.131.40:50001

  • 91.220.131.40:50002

Attributes
  • service_name

    Enterprise Mailing Service

Extracted

Family

  • sality

C2

  • http://89.119.67.154/testo5/

  • http://kukutrustnet777.info/home.gif

  • http://kukutrustnet888.info/home.gif

  • http://kukutrustnet987.info/home.gif

Targets

    • Target
      RNSM00262.7z
    • Size 23.5MB
    • SHA256 de0bf2df04a896629563c8142a4a3916ee98a445c954da5da7c6752aa9ed78ca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    blackshadessalitysendsafeunregisteredbackdoorbotnetdefense_evasiondiscoverypersistenceratspamtrojanupx

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

      ratblackshades

    • Blackshades family

      blackshades

    • Blackshades payload

    • Modifies WinLogon for persistence

      persistence

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • Sality family

      sality

    • SendSafe

      SendSafe is a notorious spam tool which then turned into spam botnet.

      spambotnetsendsafe

    • Sendsafe family

      sendsafe

    • SendSafe payload

      botnet

    • Executes dropped EXE

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks