Extracted

• • Target
    2026-09-29_360fb1da9ab7eb52cd5cb2335122e40e_coinminer_dosia_elex_frostygoop_glassworm_hive_poet-rat_quasar-rat_salatstealer_sliver_snatch_zxxz
  • Size 22.4MB
  • SHA256 36ffb8b5986f802a58719801aaa8a777f5b81a8cb904bb0794f131483b6555d9
  • MD5 360fb1da9ab7eb52cd5cb2335122e40e
  • SHA1 ea442f61d5c5ec2bd37d7ce3f0bd591ea03720e9
  • SHA512 11dac8130dafc5b987e3dd7892a76a0c4a022dac5a174511df37d585f09ca83b19b00fdd890f99f3a7b2df9b0a8dd2d2329f15ac02ebca021bb1a6c444180d7c
  • SSDEEP 196608:WfEXOcD4OBMhghhXFC7JbO1zbalMF09BQ9jwpX:ZJ9hwlbPZ6jw9
  • TLSH
    T1A7372851EAC741F6F90758B1409BB23F23309D058F28CAD7EB407F6AE837A92593B645
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2