Extracted

• • Target
    2026-08-13_d1d79f0d00fbd31ad794bf9e315c3551_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry
  • Size 244KB
  • SHA256 9cce8552277ef2523fb27b2a0e2bb1a7ffb80abbeec3f77603a1a0f9ba7fdf67
  • MD5 d1d79f0d00fbd31ad794bf9e315c3551
  • SHA1 c9567fdbc8e6d9fd3d6f2e0255c4ee4ff2ea3084
  • SHA512 bbe47fea53f338b70973d9c3adac26cb5c76feaad850e796520d8b4d81bcb315a6867d3ca2042d7a9599798680b1c5b99690cbb914d3e00f64829d5e7a9095d0
  • SSDEEP 6144:y7GqcWxc5tTBsJWKFGUOfCs/pXtwrzJhp56ZY0+y32e:SBpxc5tTG7FE6yXtwrzlWY0V
  • TLSH
    T1C934DF19399089B2C0BFC4B7C0E5BB39F7B633321366D94B675C96740E22766F6112CA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2