Extracted

• • Target
    2026-06-06_5f65975d2923d3456bd2873de0c65e98_cobalt-strike_coinminer_elex_glassworm_poet-rat_sliver_snatch
  • Size 6.9MB
  • SHA256 4bbd72d9ef76b43faeca7ada4fdf32f930c2144730f4f90dd5c6b3c6c8552b7f
  • MD5 5f65975d2923d3456bd2873de0c65e98
  • SHA1 182c43946ebf66eeefe956e7494cbd2f3a104fca
  • SHA512 cc8de87fa3e11d2710fb27639654d14a4e8a6ed3a527cf463b6a3be25c453fe5ebbbc4e9fb330821a1206b17f698becd2096a3c02e92e6100c10f393fccf3a86
  • SSDEEP 49152:dN5GMlv/H3xONiz8xmHVibPyZ6fe/ZLYwSdT3aYPAFw4OtpCw/PAd1hFUlMXi5g7:7lvsigIHV+m6fmLbPXXKS5vfbh
  • TLSH
    T1FD765A82FD9F14B2EB8713B084B6132FB730B5050336EAC3DE545A67E4276E96A37251
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2