Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

98e7689be6...73.exe

windows7-x64

10

98e7689be6...73.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    98e7689be6983f2b0d99c85c332e2f48a2cb84273312a1128f4ee99ac4fa1573

  • Size

    98KB

  • Sample

    221002-epaxksheeq

  • MD5

    65bcac317640ce7a86709663394296f0

  • SHA1

    fc51a6d78f7540d888a96a6f82ceadfa4ff5c211

  • SHA256

    98e7689be6983f2b0d99c85c332e2f48a2cb84273312a1128f4ee99ac4fa1573

  • SHA512

    e3bc21d37c2d0e42cd46a17ac0c470298aafd48872c3f354d456edd9358209a0ba36d95518c014333bec40a260a19a023a1c7e886a60b84fae0884d6c4c809bf

  • SSDEEP

    1536:ezQvP+O3qnwGL//S/d+1w72MFpZtlQ4cQKlBz5AGQuQ8Il:ezQHNQwGr6d+1O2mtK4cQK7pQuQz

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

http://klkjwre77638dfqwieuoi888.info/

Targets

    • Target

      98e7689be6983f2b0d99c85c332e2f48a2cb84273312a1128f4ee99ac4fa1573

    • Size

      98KB

    • MD5

      65bcac317640ce7a86709663394296f0

    • SHA1

      fc51a6d78f7540d888a96a6f82ceadfa4ff5c211

    • SHA256

      98e7689be6983f2b0d99c85c332e2f48a2cb84273312a1128f4ee99ac4fa1573

    • SHA512

      e3bc21d37c2d0e42cd46a17ac0c470298aafd48872c3f354d456edd9358209a0ba36d95518c014333bec40a260a19a023a1c7e886a60b84fae0884d6c4c809bf

    • SSDEEP

      1536:ezQvP+O3qnwGL//S/d+1w72MFpZtlQ4cQKlBz5AGQuQ8Il:ezQHNQwGr6d+1O2mtK4cQK7pQuQz

    Score
    10/10
    salitybackdoorevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks