sality | 2026-09-29_ebc1e9efd8c43bf903b320aad3150941_coinminer_elex_sality_stop

General

Target
2026-09-29_ebc1e9efd8c43bf903b320aad3150941_coinminer_elex_sality_stop
Size 723KB
Sample260930-stgsksbe39
SHA256 daf4f84f1284b30216871d2b91ab69a794e9328fb267b0167afbc95940df724f
MD5 ebc1e9efd8c43bf903b320aad3150941
SHA1 cba3467ae69eb7bb98f6c12ee5699f4c3e3ccf80
SHA512 9a8fb53cd15e182460b205bd87eaa8c6d1f56789cf1d98e6687ebcca0202df7893c757e69c4998dc9c5217ba93e8716ec90b8b9b4a9217d6a0712056f8a626fb
SSDEEP 3072:okBhs0MpYaz70WM8GO+9/7VDjYu97oX+TQuu12p:lBhsXR0WrGO+9/JDjYGoX+Tua
TLSH
T145F43B51E280D475F6E3E0F86A67C2F7AA583EF411716093B7C46E2399B06B5F722903
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx backdoor sality

Family: Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_ebc1e9efd8c43bf903b320aad3150941_coinminer_elex_sality_stop

2026-09-29_ebc1e9efd8c43bf903b320aad3150941_coinminer_elex_sality_stop

.exe 723KB

SHA256 daf4f84f1284b30216871d2b91ab69a794e9328fb267b0167afbc95940df724f
MD5 ebc1e9efd8c43bf903b320aad3150941
SHA1 cba3467ae69eb7bb98f6c12ee5699f4c3e3ccf80
SHA512 9a8fb53cd15e182460b205bd87eaa8c6d1f56789cf1d98e6687ebcca0202df7893c757e69c4998dc9c5217ba93e8716ec90b8b9b4a9217d6a0712056f8a626fb
SSDEEP 3072:okBhs0MpYaz70WM8GO+9/7VDjYu97oX+TQuu12p:lBhsXR0WrGO+9/JDjYGoX+Tua
TLSH
T145F43B51E280D475F6E3E0F86A67C2F7AA583EF411716093B7C46E2399B06B5F722903
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

752320

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths