sality | 20096e3778f9927d74e03299b309225844b99647c4b5b48dc0e9b9e79de92c3f | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

20096e3778...3f.exe

windows7-x64

20096e3778...3f.exe

windows10-2004-x64

Sharing

General

Target

20096e3778f9927d74e03299b309225844b99647c4b5b48dc0e9b9e79de92c3f
Size

1012KB
Sample

221010-3md38aecb6
MD5

7cea36e7e2ae05dfa419c1b732459a36
SHA1

3dd746f0bd26f1dd7e13efe2bab2f1b83020606e
SHA256

20096e3778f9927d74e03299b309225844b99647c4b5b48dc0e9b9e79de92c3f
SHA512

c182e18ffd1fb9067acb24f37d6343db467506db0debab8e9fb76e9181959f3d1330cd7af836aedc0ed6f4f3efdf41f4d28ad1fbcede9323f7272404cc0510cd
SSDEEP

12288:nrg85zgRS99vH5C78pnMULnGTyW1hMW6/cNExJd2iCLdrt3C:nrrGS3H5CmW16+WYiIdw

Score

10^/10

sality backdoor evasion trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

20096e3778f9927d74e03299b309225844b99647c4b5b48dc0e9b9e79de92c3f.exe

Resource

win7-20220812-en

sality backdoor evasion trojan upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

20096e3778f9927d74e03299b309225844b99647c4b5b48dc0e9b9e79de92c3f.exe

Resource

win10v2004-20220812-en

sality backdoor upx

windows10-2004-x64

3 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  20096e3778f9927d74e03299b309225844b99647c4b5b48dc0e9b9e79de92c3f
- Size
  
  1012KB
- MD5
  
  7cea36e7e2ae05dfa419c1b732459a36
- SHA1
  
  3dd746f0bd26f1dd7e13efe2bab2f1b83020606e
- SHA256
  
  20096e3778f9927d74e03299b309225844b99647c4b5b48dc0e9b9e79de92c3f
- SHA512
  
  c182e18ffd1fb9067acb24f37d6343db467506db0debab8e9fb76e9181959f3d1330cd7af836aedc0ed6f4f3efdf41f4d28ad1fbcede9323f7272404cc0510cd
- SSDEEP
  
  12288:nrg85zgRS99vH5C78pnMULnGTyW1hMW6/cNExJd2iCLdrt3C:nrrGS3H5CmW16+WYiIdw
Score

10^/10

sality backdoor evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorevasiontrojanupx

behavioral2

salitybackdoorupx

© 2018-2025

Terms | Privacy