sality | 2026-09-29_31cb7b8b3f398d83c27be65c67a06dc8_coinminer_elex_sality_stop

General

Target
2026-09-29_31cb7b8b3f398d83c27be65c67a06dc8_coinminer_elex_sality_stop
Size 725KB
Sample260930-2efrea1wft
SHA256 39e01a7b4acd360011112e7d1f362d1d840146973b54df11b459125b9db72047
MD5 31cb7b8b3f398d83c27be65c67a06dc8
SHA1 eda04c34da0748d8ab3759381fbd9c88a54a711e
SHA512 b82f83544cd0cb7953d9ea24b3bc43891f394b01ce35134a345876c1235ad3a0a02a3caa17f811b849e08f9c7e203b5b2bd47023f83625b55afe3e95594a88be
SSDEEP 3072:KkBhs0MpYaz70WM8GO+9/7VDjYu97oX+T/V112p:nBhsXR0WrGO+9/JDjYGoX+TRa
TLSH
T1DFF43B51E280D475F6E3E0F86A67C2F7AA583EB411716093B7C46E2399B06B5F722903
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx backdoor sality

Family: Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_31cb7b8b3f398d83c27be65c67a06dc8_coinminer_elex_sality_stop

2026-09-29_31cb7b8b3f398d83c27be65c67a06dc8_coinminer_elex_sality_stop

.exe 725KB

SHA256 39e01a7b4acd360011112e7d1f362d1d840146973b54df11b459125b9db72047
MD5 31cb7b8b3f398d83c27be65c67a06dc8
SHA1 eda04c34da0748d8ab3759381fbd9c88a54a711e
SHA512 b82f83544cd0cb7953d9ea24b3bc43891f394b01ce35134a345876c1235ad3a0a02a3caa17f811b849e08f9c7e203b5b2bd47023f83625b55afe3e95594a88be
SSDEEP 3072:KkBhs0MpYaz70WM8GO+9/7VDjYu97oX+T/V112p:nBhsXR0WrGO+9/JDjYGoX+TRa
TLSH
T1DFF43B51E280D475F6E3E0F86A67C2F7AA583EB411716093B7C46E2399B06B5F722903
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

752320

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths