Extracted

• • Target
    2026-08-13_7a2f8b609fa37b0e5b0e5c613e9185e6_elex_wannacry
  • Size 216KB
  • SHA256 df12a72bf0530b1a5705f34ae35035f9f55c5cc753a4dab5a0a197a3a6e7db7c
  • MD5 7a2f8b609fa37b0e5b0e5c613e9185e6
  • SHA1 9f7cec3cd84bdb03e8405884fc18fb10b163b6cb
  • SHA512 d4f335ffa8ff41b1f74d503df575329ee26f6361cab102522b0f24470ddd3050489c533484c7f11ab882ce352aefba5dcc955622328b994bb7504753d72b0dac
  • SSDEEP 3072:eQkOur2kDrMPi0+AAmlaNXHv9FGQYvYNt6oXXQ1SkZ1pyiv58AKC:9uzXKiZ5m4B6QYvsoe2SCfyS
  • TLSH
    T15324F1033AC78452FD388530D5AD0B6DD6332E742B9C45D69BA03E3C397A5C99DE871A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2