sality | d31aa4c27840f1fb906eb18544dc08b2a4ca6ea9507f28c0034980e59a014f16 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

d31aa4c278...16.exe

windows7-x64

d31aa4c278...16.exe

windows10-2004-x64

Sharing

General

Target

d31aa4c27840f1fb906eb18544dc08b2a4ca6ea9507f28c0034980e59a014f16
Size

795KB
Sample

221028-x6p2yacch2
MD5

041c73cd7d43896f7a0a021593abb160
SHA1

888adb1dac724445b6ba73edeeb72f50d92c8821
SHA256

d31aa4c27840f1fb906eb18544dc08b2a4ca6ea9507f28c0034980e59a014f16
SHA512

f29ca77bc94526d847e57da188203c5b42926c3a36f7a441f1fb105444427db827f323f7aced358ce152a0b3e1d39562b94a24e1fdef0f398cae417de1af09ff
SSDEEP

12288:1NFlcr2LDUiO2s/CzjfNm1eNqK9h/8VnejbBqgVFbNNHyBGAoViUff:1NFlceObgTNFL8VKAWFHQGA7Uf

Score

10^/10

sality backdoor evasion trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

d31aa4c27840f1fb906eb18544dc08b2a4ca6ea9507f28c0034980e59a014f16.exe

Resource

win7-20220812-en

sality backdoor evasion trojan upx

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

d31aa4c27840f1fb906eb18544dc08b2a4ca6ea9507f28c0034980e59a014f16.exe

Resource

win10v2004-20220812-en

sality backdoor evasion trojan upx

windows10-2004-x64

4 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  d31aa4c27840f1fb906eb18544dc08b2a4ca6ea9507f28c0034980e59a014f16
- Size
  
  795KB
- MD5
  
  041c73cd7d43896f7a0a021593abb160
- SHA1
  
  888adb1dac724445b6ba73edeeb72f50d92c8821
- SHA256
  
  d31aa4c27840f1fb906eb18544dc08b2a4ca6ea9507f28c0034980e59a014f16
- SHA512
  
  f29ca77bc94526d847e57da188203c5b42926c3a36f7a441f1fb105444427db827f323f7aced358ce152a0b3e1d39562b94a24e1fdef0f398cae417de1af09ff
- SSDEEP
  
  12288:1NFlcr2LDUiO2s/CzjfNm1eNqK9h/8VnejbBqgVFbNNHyBGAoViUff:1NFlceObgTNFL8VKAWFHQGA7Uf
Score

10^/10

sality backdoor evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorevasiontrojanupx

behavioral2

salitybackdoorevasiontrojanupx

© 2018-2025

Terms | Privacy