Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a23bb58ae7ffb23c1f5b877d87978b10.exe

  • Size

    1012KB

  • Sample

    240108-ywa1psgghj

  • MD5

    a23bb58ae7ffb23c1f5b877d87978b10

  • SHA1

    2d3a5f3894325fa1553507c15be3fcc34eec9cca

  • SHA256

    969d86f872448654ec18e98d7277ff124b7cc26f515008a954bd21d10b35a586

  • SHA512

    dd185942e486343c479a3f87b37175893d5fd51aeb7d721959f582560c3fe87fcbca614f491b8fa90fb318053dee62a546ae8eac7ba25bdcc3cd3ee92990ec10

  • SSDEEP

    12288:k1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0INK4h1oWxJpcEi0/3IWV//7cSdbuPcCn:k1/aGLDCM4D8ayGM0R3o8/HuPfDQy

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      a23bb58ae7ffb23c1f5b877d87978b10.exe

    • Size

      1012KB

    • MD5

      a23bb58ae7ffb23c1f5b877d87978b10

    • SHA1

      2d3a5f3894325fa1553507c15be3fcc34eec9cca

    • SHA256

      969d86f872448654ec18e98d7277ff124b7cc26f515008a954bd21d10b35a586

    • SHA512

      dd185942e486343c479a3f87b37175893d5fd51aeb7d721959f582560c3fe87fcbca614f491b8fa90fb318053dee62a546ae8eac7ba25bdcc3cd3ee92990ec10

    • SSDEEP

      12288:k1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0INK4h1oWxJpcEi0/3IWV//7cSdbuPcCn:k1/aGLDCM4D8ayGM0R3o8/HuPfDQy

    • Modifies firewall policy service

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • UAC bypass

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Adds Run key to start application

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.