Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    da5d969828b0abbf7d37e6cabac08f5e_JaffaCakes118

  • Size

    500KB

  • Sample

    240911-pt7r8a1alp

  • MD5

    da5d969828b0abbf7d37e6cabac08f5e

  • SHA1

    f4ec4afbe6d51de2d4f71bfb0a776e4056c0d2e1

  • SHA256

    61568b37f7ec71a5c63317594710d224d05ab81abcc37a270e25fb652675ab76

  • SHA512

    2aa2ac83e5ac1c8d5e9b1597e1f3603fd2ae0c58002b54cb44df806d5e52f755b736b99d320d5266ef006305aaf040ad842a19156ab56c59648f5e2d93b1cf4c

  • SSDEEP

    6144:oQ3IupEcvZF+v6O3W3dbTHeh6RRILGrorX0eziIj:P3jp1vo6yCbTHQ+fGiIj

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

    • Target

      da5d969828b0abbf7d37e6cabac08f5e_JaffaCakes118

    • Size

      500KB

    • MD5

      da5d969828b0abbf7d37e6cabac08f5e

    • SHA1

      f4ec4afbe6d51de2d4f71bfb0a776e4056c0d2e1

    • SHA256

      61568b37f7ec71a5c63317594710d224d05ab81abcc37a270e25fb652675ab76

    • SHA512

      2aa2ac83e5ac1c8d5e9b1597e1f3603fd2ae0c58002b54cb44df806d5e52f755b736b99d320d5266ef006305aaf040ad842a19156ab56c59648f5e2d93b1cf4c

    • SSDEEP

      6144:oQ3IupEcvZF+v6O3W3dbTHeh6RRILGrorX0eziIj:P3jp1vo6yCbTHQ+fGiIj

    • Modifies firewall policy service

    • Sality

      Sality is backdoor written in C++, first discovered in 2003.

    • UAC bypass

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.