sality | 7d70c93eb377523db0fd54229947e1907b18e1f2a06b7f403292fd3b3ac36e8d | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

7d70c93eb3...8d.exe

windows7-x64

7d70c93eb3...8d.exe

windows10-2004-x64

Sharing

General

Target

7d70c93eb377523db0fd54229947e1907b18e1f2a06b7f403292fd3b3ac36e8d
Size

2.2MB
Sample

231021-kstrrafb86
MD5

6546fb9ff12b3f68250c56a13fe2f129
SHA1

9f6025ecb1bd145c36204c0cb37d2c8d4429c955
SHA256

7d70c93eb377523db0fd54229947e1907b18e1f2a06b7f403292fd3b3ac36e8d
SHA512

32f5a05eea210d88f79b6f049eff56263e34a21c905ec0148ef3a68495704858ef8b693b4e92274b0cf12e9c7c905d47833f87de00c7383bc2261aceb9384ff0
SSDEEP

49152:fNFbZHkDXHY4RUM6yutBZlfIzOdO3mhS87NrWOPKV1fXLvcsZ9:fNRZHkDXHYkU6wBkzN3U7NrW7

Score

10^/10

sality backdoor discovery evasion trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

7d70c93eb377523db0fd54229947e1907b18e1f2a06b7f403292fd3b3ac36e8d.exe

Resource

win7-20231020-en

sality backdoor discovery upx

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral2

Sample

7d70c93eb377523db0fd54229947e1907b18e1f2a06b7f403292fd3b3ac36e8d.exe

Resource

win10v2004-20230915-en

sality backdoor discovery evasion trojan upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  7d70c93eb377523db0fd54229947e1907b18e1f2a06b7f403292fd3b3ac36e8d
- Size
  
  2.2MB
- MD5
  
  6546fb9ff12b3f68250c56a13fe2f129
- SHA1
  
  9f6025ecb1bd145c36204c0cb37d2c8d4429c955
- SHA256
  
  7d70c93eb377523db0fd54229947e1907b18e1f2a06b7f403292fd3b3ac36e8d
- SHA512
  
  32f5a05eea210d88f79b6f049eff56263e34a21c905ec0148ef3a68495704858ef8b693b4e92274b0cf12e9c7c905d47833f87de00c7383bc2261aceb9384ff0
- SSDEEP
  
  49152:fNFbZHkDXHY4RUM6yutBZlfIzOdO3mhS87NrWOPKV1fXLvcsZ9:fNRZHkDXHYkU6wBkzN3U7NrW7
Score

10^/10

sality backdoor discovery upx evasion trojan
- Modifies firewall policy service
  evasion
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

salitybackdoordiscoveryupx

behavioral2

salitybackdoordiscoveryevasiontrojanupx

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.