sality | 2026-10-03_c6d460a81429448ff30ebd2b5937cd65_coinminer_elex_keatepb_sality_wannacry

General

Target
2026-10-03_c6d460a81429448ff30ebd2b5937cd65_coinminer_elex_keatepb_sality_wannacry
Size 557KB
Sample261004-cae7msst6j
SHA256 089a767e5e5895cb7c6d6626de0f62347ff39d4266874a68b6bac50659ba9b05
MD5 c6d460a81429448ff30ebd2b5937cd65
SHA1 b16427f1562c0a622903e0ee0922e491e603cc5e
SHA512 3367bbbc8b5d84a8b2d1f877c7db194adf7fa557feef6428dfcd8439eecd594c87e69c55df41a409f007dec5ddcd122aa494ae9bdfdfd6cc7d6d597a643c0639
SSDEEP 6144:zeZ6tij4GAlJJyEgUE/2VCosBvs/g+xS:zeZhj4GmyE2oVRxS
TLSH
T146C45C55E280C479D4E390F8666FC6B6A9583EF11275A093B3C49E37A9703F1F723A12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx backdoor sality

Family: Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-03_c6d460a81429448ff30ebd2b5937cd65_coinminer_elex_keatepb_sality_wannacry

2026-10-03_c6d460a81429448ff30ebd2b5937cd65_coinminer_elex_keatepb_sality_wannacry

.exe 557KB

SHA256 089a767e5e5895cb7c6d6626de0f62347ff39d4266874a68b6bac50659ba9b05
MD5 c6d460a81429448ff30ebd2b5937cd65
SHA1 b16427f1562c0a622903e0ee0922e491e603cc5e
SHA512 3367bbbc8b5d84a8b2d1f877c7db194adf7fa557feef6428dfcd8439eecd594c87e69c55df41a409f007dec5ddcd122aa494ae9bdfdfd6cc7d6d597a643c0639
SSDEEP 6144:zeZ6tij4GAlJJyEgUE/2VCosBvs/g+xS:zeZhj4GmyE2oVRxS
TLSH
T146C45C55E280C479D4E390F8666FC6B6A9583EF11275A093B3C49E37A9703F1F723A12
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

572624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths