Extracted

• • Target
    2026-04-22_5b31b245ca2e539a410061a6a91db406_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry
  • Size 252KB
  • SHA256 033f9bd1192e83b8a3bebdb0262f00f599734f5d64a7f0f7734efaa1cd551c6c
  • MD5 5b31b245ca2e539a410061a6a91db406
  • SHA1 aee3aef8c2d7eaa732b62c8f3c8b62e6e94d53b8
  • SHA512 3ce4d7362926a4508f9027b06ada565bcb9d6adb019dc9d2a7980b22b54304f05cc652416c34e9bd777c39b0d494973a86b319574193ecda027bcf8d77a041f6
  • SSDEEP 6144:U70qcWxc5tTBsJWKFGUOfCYPkmVHkgc02M1Ipa/Ph:Q/pxc5tTG7FE6d0SpA
  • TLSH
    T12244DF1939A089B3D07FD0B7C1E1BB29F77772321326D94B67AC96301E62726F6211C6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan
  • Custom signature

    Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • Custom signature

    UPX dump on OEP (original entry point)

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2