sality | 2026-10-16_181f79bafa741926d6524854ba951819_coinminer_elex_sality_wannacry

General

Target
2026-10-16_181f79bafa741926d6524854ba951819_coinminer_elex_sality_wannacry
Size 557KB
Sample261017-2vr5daew6w
SHA256 07ae164686fa51cb42b3371881cf636d7fe042cdc1df9d7c06d7e483d20dfd85
MD5 181f79bafa741926d6524854ba951819
SHA1 645a44741ee51ee2ba9c77be2dcaafdc373b6507
SHA512 6ea8932cc8419b5c5d310bf41ce55f18eb6dadddf7d544020d35826c40b74f63579690350d00bc6b45896a3d6fc22bc801c38534a1f1ab29692e29182e141e57
SSDEEP 3072:FkXGYwG0BWhdHtRBLoIpkIEc29i8/2VnYB2dyMu2tsk:BYwGgWTHtRBLoIpJEcR8/2VYB20MuVk
TLSH
T167C42944E280D475D4D393B86A6BDEF6A9583EB013319093B3C49F67AA706B6F702743
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx backdoor sality

Family: Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_181f79bafa741926d6524854ba951819_coinminer_elex_sality_wannacry

2026-10-16_181f79bafa741926d6524854ba951819_coinminer_elex_sality_wannacry

.exe 557KB

SHA256 07ae164686fa51cb42b3371881cf636d7fe042cdc1df9d7c06d7e483d20dfd85
MD5 181f79bafa741926d6524854ba951819
SHA1 645a44741ee51ee2ba9c77be2dcaafdc373b6507
SHA512 6ea8932cc8419b5c5d310bf41ce55f18eb6dadddf7d544020d35826c40b74f63579690350d00bc6b45896a3d6fc22bc801c38534a1f1ab29692e29182e141e57
SSDEEP 3072:FkXGYwG0BWhdHtRBLoIpkIEc29i8/2VnYB2dyMu2tsk:BYwGgWTHtRBLoIpJEcR8/2VYB20MuVk
TLSH
T167C42944E280D475D4D393B86A6BDEF6A9583EB013319093B3C49F67AA706B6F702743
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

572080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths