sality | 2026-09-29_dbcfbfb0c408e20cafbc152d103a343d_coinminer_elex_sality_stop

General

Target
2026-09-29_dbcfbfb0c408e20cafbc152d103a343d_coinminer_elex_sality_stop
Size 725KB
Sample260930-tkcypswy2n
SHA256 0a0bcf3bbe7ce31c09ed447df15feaadccb4990b51b3b1f337482a5ef6351c58
MD5 dbcfbfb0c408e20cafbc152d103a343d
SHA1 299442092f47c937e3e60cda69e991b366695c2e
SHA512 5f85be3125ef2e5642b19294b632d072f741fae390eb99764a8ce943f9ca2620dddbba4a6e6443c991c2026549f44198b6d10530cf4678bcc43947926da01567
SSDEEP 3072:KkBhs0MpYaz70WM8GO+9/7VDjYu97oX+T/U112p:nBhsXR0WrGO+9/JDjYGoX+Taa
TLSH
T1DAF43B51E280D475F6E3E0F86A67C2F7AA583EF411716093B7C46E2399B06B5F722903
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx backdoor sality

Family: Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_dbcfbfb0c408e20cafbc152d103a343d_coinminer_elex_sality_stop

2026-09-29_dbcfbfb0c408e20cafbc152d103a343d_coinminer_elex_sality_stop

.exe 725KB

SHA256 0a0bcf3bbe7ce31c09ed447df15feaadccb4990b51b3b1f337482a5ef6351c58
MD5 dbcfbfb0c408e20cafbc152d103a343d
SHA1 299442092f47c937e3e60cda69e991b366695c2e
SHA512 5f85be3125ef2e5642b19294b632d072f741fae390eb99764a8ce943f9ca2620dddbba4a6e6443c991c2026549f44198b6d10530cf4678bcc43947926da01567
SSDEEP 3072:KkBhs0MpYaz70WM8GO+9/7VDjYu97oX+T/U112p:nBhsXR0WrGO+9/JDjYGoX+Taa
TLSH
T1DAF43B51E280D475F6E3E0F86A67C2F7AA583EF411716093B7C46E2399B06B5F722903
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

752320

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths