Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

401d2db935...aa.exe

windows7-x64

10

401d2db935...aa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    401d2db9356ecf7e2aa329084ec9ac6042e465addc5936607d257a669be4ceaa

  • Size

    200KB

  • Sample

    221002-esxwhsgdg5

  • MD5

    6e1416a60cc716bafb81fdc6584b7230

  • SHA1

    64331c53c871b0853d26a4baa2ae869e9a97b4ce

  • SHA256

    401d2db9356ecf7e2aa329084ec9ac6042e465addc5936607d257a669be4ceaa

  • SHA512

    b0582dc9cead14b5ded3377633e59d9746c2c5fddeaf360c69ead079378ac908cc699557d4732b78e7cfe5df67499b546a1fa56e8af16827d18217ba597c60f4

  • SSDEEP

    3072:AcmVWc5ltbmP3Q7yHG5eIIZIIA3wu2kj7qxppN1B7Jvz3624ULeuYZb7EnHglkKk:nmUIRf3j2ZzN1B7VZ4luYPQwU

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      401d2db9356ecf7e2aa329084ec9ac6042e465addc5936607d257a669be4ceaa

    • Size

      200KB

    • MD5

      6e1416a60cc716bafb81fdc6584b7230

    • SHA1

      64331c53c871b0853d26a4baa2ae869e9a97b4ce

    • SHA256

      401d2db9356ecf7e2aa329084ec9ac6042e465addc5936607d257a669be4ceaa

    • SHA512

      b0582dc9cead14b5ded3377633e59d9746c2c5fddeaf360c69ead079378ac908cc699557d4732b78e7cfe5df67499b546a1fa56e8af16827d18217ba597c60f4

    • SSDEEP

      3072:AcmVWc5ltbmP3Q7yHG5eIIZIIA3wu2kj7qxppN1B7Jvz3624ULeuYZb7EnHglkKk:nmUIRf3j2ZzN1B7VZ4luYPQwU

    Score
    10/10
    salitybackdoorevasiontrojanupx

    • Modifies firewall policy service

      evasion

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

      backdoorsality

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks