Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179

  • Size

    167KB

  • Sample

    221020-3mttnsbfe4

  • MD5

    4e8bd18c20a9b053f9727eb5f8e3c037

  • SHA1

    5d4750302bbef963434d8ce660a9ba618987cf5f

  • SHA256

    f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179

  • SHA512

    48a8cbbb886ad80b1d9d1835ceda6c822dbb0fc991d5fe6e44570d5f04939ca3a9534df7756f5c5811efdd7677cf76707f212fa7d474dff5a8b0f7cfda2e2393

  • SSDEEP

    3072:hvzNWVMw6g5ZX73Plewmh0Bx4rWDNvXwmas/V74Ilj3qozhAvsx:FNWVM5wmSErWpvNeIp7Sy

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179

    • Size

      167KB

    • MD5

      4e8bd18c20a9b053f9727eb5f8e3c037

    • SHA1

      5d4750302bbef963434d8ce660a9ba618987cf5f

    • SHA256

      f46055f4579a7a80c03419eb069bf086b96d8ad72693d0faaae701893a966179

    • SHA512

      48a8cbbb886ad80b1d9d1835ceda6c822dbb0fc991d5fe6e44570d5f04939ca3a9534df7756f5c5811efdd7677cf76707f212fa7d474dff5a8b0f7cfda2e2393

    • SSDEEP

      3072:hvzNWVMw6g5ZX73Plewmh0Bx4rWDNvXwmas/V74Ilj3qozhAvsx:FNWVM5wmSErWpvNeIp7Sy

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • UAC bypass

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Executes dropped EXE

    • Modifies Windows Firewall

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks