Extracted

• • Target
    2026-07-02_1ded6bb415a9c1dc95c317f269634e5d_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry
  • Size 4.8MB
  • SHA256 0d8cc20a586a658f683cdd73b0c92db8fcd3de998befdca4f763609b242e3c03
  • MD5 1ded6bb415a9c1dc95c317f269634e5d
  • SHA1 a56c509290826442eca3f5dd8c91db41331de01b
  • SHA512 605a4645903c017e140a84212bc0ba13dbc2d2265e5cff743da7682d3c2e4c0f6013f2912a01f29d3f00c76d967e4deade89c0ecd84cb143fd54867127b7d635
  • SSDEEP 98304:6dfaKuuG6vKIKj4u8cKu3/lc96hxvWbrtUTrUHO2q:RuvA58cKm/lcAx+NcIOX
  • TLSH
    T1A836BF12B381D833C1372A388D5B97A8A93ABE203F3894477FB42E5C1F797817925597
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2