Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f

  • Size

    672KB

  • Sample

    221123-wnvn2ace55

  • MD5

    4562f9542486b1aa6bf992123ded1f91

  • SHA1

    e9744f0a0262c79094e4c4395d0465a30cccd2d9

  • SHA256

    1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f

  • SHA512

    f43cece6b18792dfa2c6e8a04c68ceab1c9ce1a9ac6f30501166d1a51b2c63044ccad2e15e9c9d3c7f154eb9c6a368f5073373ddfdd25080a450b5ed06f5cd6c

  • SSDEEP

    12288:zNdwLIYTAGmmvNOFvXhJfnUhhrBoZ5p+cKdxFu2BYGqA8kKZtXhLVWdI:ZdwhAGmgevX+hrBu/GO2BYG38kKxpK

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

    • Target

      1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f

    • Size

      672KB

    • MD5

      4562f9542486b1aa6bf992123ded1f91

    • SHA1

      e9744f0a0262c79094e4c4395d0465a30cccd2d9

    • SHA256

      1a1b2bc15397564dd16ab4bbebab352adecef93b644707ea067256a68ba4945f

    • SHA512

      f43cece6b18792dfa2c6e8a04c68ceab1c9ce1a9ac6f30501166d1a51b2c63044ccad2e15e9c9d3c7f154eb9c6a368f5073373ddfdd25080a450b5ed06f5cd6c

    • SSDEEP

      12288:zNdwLIYTAGmmvNOFvXhJfnUhhrBoZ5p+cKdxFu2BYGqA8kKZtXhLVWdI:ZdwhAGmgevX+hrBu/GO2BYG38kKxpK

    • Modifies firewall policy service

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • UAC bypass

    • Windows security bypass

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks