sality | 917ee0a0141b5cedf9abccabaf21e8f64cf81c115c66ea30b609813b70d0d6f7 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

917ee0a014...f7.exe

windows7-x64

917ee0a014...f7.exe

windows10-2004-x64

Sharing

General

Target

917ee0a0141b5cedf9abccabaf21e8f64cf81c115c66ea30b609813b70d0d6f7
Size

261KB
Sample

221106-f2ypvaead2
MD5

0a87ae0e78763737168f5dc508fc7da0
SHA1

017097e9ad4405cea9e77478cd679eef12b9630f
SHA256

917ee0a0141b5cedf9abccabaf21e8f64cf81c115c66ea30b609813b70d0d6f7
SHA512

e6390c18a2097410dc7fb32adce6e9024a54f08632f3b9a139e7ccd9ceb87f639ebaf160ec6c6bac8fcdcd908fc7ffa17bf1410805c0e06387ed57ebb1d985e5
SSDEEP

6144:0Fc66UZNvw2M6by5/iq/4cw5hGtDiBuQ+e/o:F66UtLW/iq/4cw5yieio

Score

10^/10

sality backdoor evasion trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

917ee0a0141b5cedf9abccabaf21e8f64cf81c115c66ea30b609813b70d0d6f7.exe

Resource

win7-20220812-en

sality backdoor evasion trojan upx

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

917ee0a0141b5cedf9abccabaf21e8f64cf81c115c66ea30b609813b70d0d6f7.exe

Resource

win10v2004-20220812-en

sality backdoor evasion trojan upx

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  917ee0a0141b5cedf9abccabaf21e8f64cf81c115c66ea30b609813b70d0d6f7
- Size
  
  261KB
- MD5
  
  0a87ae0e78763737168f5dc508fc7da0
- SHA1
  
  017097e9ad4405cea9e77478cd679eef12b9630f
- SHA256
  
  917ee0a0141b5cedf9abccabaf21e8f64cf81c115c66ea30b609813b70d0d6f7
- SHA512
  
  e6390c18a2097410dc7fb32adce6e9024a54f08632f3b9a139e7ccd9ceb87f639ebaf160ec6c6bac8fcdcd908fc7ffa17bf1410805c0e06387ed57ebb1d985e5
- SSDEEP
  
  6144:0Fc66UZNvw2M6by5/iq/4cw5hGtDiBuQ+e/o:F66UtLW/iq/4cw5yieio
Score

10^/10

sality backdoor evasion trojan upx
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoorevasiontrojanupx

behavioral2

salitybackdoorevasiontrojanupx

© 2018-2025

Terms | Privacy