Extracted

• • Target
    2026-11-13_b7fe562c1a576934792fd0bbb0083223_elex_wannacry
  • Size 138KB
  • SHA256 26d18fa091cf2663ef0434aa77d6559227c80f0472801806d590a3c38ef30f48
  • MD5 b7fe562c1a576934792fd0bbb0083223
  • SHA1 4a10987b21838c5218ac806febc18dce46cce4e2
  • SHA512 1ef0cc3aa4f873125b329b3032a24a5b23059f56735cad3ad13c6e7540c4bb14eef06fb8557bbeb8cad17a829560b80d7380f498f6b1a086a1f6e8847d028990
  • SSDEEP 3072:/gYBhxbWzSDADeak7dJHB/A1tbkakMMlH9eZ2jMOQ9AFBX6R:YYBoSsQLH5AQZl9eZ2lQeF+
  • TLSH
    T129D3F1842FA70F92F8122FF9465BAD1FC7149F651B2076D7BF854D528030298ECF6296
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan
  • Custom signature

    Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • Custom signature

    UPX dump on OEP (original entry point)

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2