Extracted

• • Target
    2026-06-27_eafe2da2c4d32399b84b4e46b2204480_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry
  • Size 328KB
  • SHA256 93ade0a7e40ab35c3130eb45a1c978da394464fbf32251bad9f69de74f15fa15
  • MD5 eafe2da2c4d32399b84b4e46b2204480
  • SHA1 68dcbb42c51f11cb89d8d56d25910db86974bffe
  • SHA512 96162b9f3ddad41fafb51430684d3c2f5a5ccf2f457035ddf0aa938efd1b0d8058af7445380d8ed073683094cae654fbcf5db8d0730e2096c9239c9eb515a6e5
  • SSDEEP 6144:Y7pqcWxc5tTBsJWKFGUOfCrgv51bXQkRnSSMGk6v0HT:sMpxc5tTG7FE6WfjRVRv0HT
  • TLSH
    T10364E1193AD089F2C06FD0B7C1E1BB29F67732311316D98B2B6C96751D73662F6212CA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupxadwarepersistenceransomwarespyware

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2