General
-
Target
12903b83a658938b752ec92a48fa6d95f14a16c6cf37dc6382c22ae7edb8603d
-
Size
132KB
-
Sample
240630-2cdt2a1bqp
-
MD5
edec6eb4b78d05e19b1c311bda88094c
-
SHA1
605616e8d132846a5a25bb21fc2787d513b7d82d
-
SHA256
12903b83a658938b752ec92a48fa6d95f14a16c6cf37dc6382c22ae7edb8603d
-
SHA512
c3eaa37cdb5f33de97562b2d8e20aa8dc1ebaeeb2493a8ac64c67f42685025dcd9b29e8668a4880688d72dc9335367256ff882923080ed922c311f75a52815a6
-
SSDEEP
3072:8ftffjmNHftffjmNuUWMYxQG3wYcgQdaNOhyfWys+7E/M:EVfjmN/VfjmN0AZ/d3hWW21
Static task
static1
Behavioral task
behavioral1
Sample
12903b83a658938b752ec92a48fa6d95f14a16c6cf37dc6382c22ae7edb8603d.exe
Resource
win7-20240611-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Targets
-
-
Target
12903b83a658938b752ec92a48fa6d95f14a16c6cf37dc6382c22ae7edb8603d
-
Size
132KB
-
MD5
edec6eb4b78d05e19b1c311bda88094c
-
SHA1
605616e8d132846a5a25bb21fc2787d513b7d82d
-
SHA256
12903b83a658938b752ec92a48fa6d95f14a16c6cf37dc6382c22ae7edb8603d
-
SHA512
c3eaa37cdb5f33de97562b2d8e20aa8dc1ebaeeb2493a8ac64c67f42685025dcd9b29e8668a4880688d72dc9335367256ff882923080ed922c311f75a52815a6
-
SSDEEP
3072:8ftffjmNHftffjmNuUWMYxQG3wYcgQdaNOhyfWys+7E/M:EVfjmN/VfjmN0AZ/d3hWW21
-
Modifies firewall policy service
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1