Extracted

• • Target
    2026-07-20_141a88daabf629bdbac8b64dcba4227f_coinminer_darkgate_elex_hijackloader_stop
  • Size 2.6MB
  • SHA256 674232f33107547c12300d42ae6ed16ef6903edf26eedc95b728395e6a087570
  • MD5 141a88daabf629bdbac8b64dcba4227f
  • SHA1 a2de96a32b076d3159cce62cf6e333195ad6a8d3
  • SHA512 9e65d173c643c5098dce2afc00a2dfaf71903b76420eaa6f3aee7804f7b087818def021585e86bda152e92ea879f76fd68db2fa565fdbb0fa517789bb1afc10b
  • SSDEEP 49152:KuGXR72fqo9owpWNAKcCXqLQZTPn/XZM/4IKY/RKYCT/uCcZRfoPqrrMMDMMM66y:wB7+pWNAHQZTPn/XZMQIRYYCLuffoPq/
  • TLSH
    T126C59F313BF28035C6723131967EA3BAA1ADAE711B3555CB25902E3D3D345C3A93972B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2