Extracted

• • Target
    2026-07-10_18f7ac5682e2213fae06370157632562_coinminer_darpapox_elex_nymaim_rhadamanthys_trickbot_wannacry
  • Size 2.6MB
  • SHA256 73914b7be2003ae95391fb102493a20d2543ea9748ea445e9d71dea758d2d21b
  • MD5 18f7ac5682e2213fae06370157632562
  • SHA1 d8141f37fc8ed64a8131007da6b6e034f0f85732
  • SHA512 7c9603541a716f89ed6789c3f1212dcc038d255dedfc5ae7defa9b64f8e37fd1744967997a06734d5f272f284a589fe7fcc466b3802c1ce3e86b1a7c055bd927
  • SSDEEP 49152:QCBEDMxbTChxKCnFnQXBbrtgb/iQvu0UHOaYmLD:QCXx6hxvWbrtUTrUHO23
  • TLSH
    T12AC59D06BA44C912D9298234A6F3CFF47776F58017034B17724CAD7F2EE3796AEA1186
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2