2026-09-29_ebc1e9efd8c43bf903b320aad3150941_coinminer_elex_sality_stop
Sality virus, coinminer, evasion
UPX image refuses to unpackSality v4 P2P bot key with filter driver
SHA-256daf4f84f1284b30216871d2b91ab69a794e9328fb267b0167afbc95940df724f
Evidence
⋯3 more rows
0x3d00000000000000000000000322e303200...........2.02.
0x3e0555058210d0908093b34842a1ef449e6UPX!....;4.*..I.
0x3f010510b00bdaa0000009c030026060041.Q..........&..A
0x400b03ad97490dbd874904cdb740026d974.:.t...t.L.t.&.t
0x420e0e1d8747026d97410fad87470e1d874...tp&.t...tp..t
0x43090dfd87490ddd874502bd97470f6d874...t...tP+.tp..t
0x44000000000903faa74303eaa74b086a974.....?.t0>.t...t
0x4506079a974c0a3a9745095a974f018aa74`y.t...tP..t...t
0x470b0e2a974b08da974905ca9745099a974...t...t.\.tP..t
0x48020e4a97490f1a9747086a974d0b6ad74 ..t...tp..t...t
0x49030b5ad748056aa7430d5a974f0eba9740..t.V.t0..t...t
0x4a00027aa74e03daa74c03faa74703caa74.'.t.=.t.?.tp<.t
0x4b0005ca974203daa74b03caa74e03eaa74.\.t =.t.<.t.>.t
0x4c0e03faa74a00aaa74908da9744040aa74.?.t...t...t@@.t
0x4d02040aa74503eaa741088a974a03da974 @.tP>.t...t.=.t
0x4e0103caa748044a974e043a974c03daa74.<.t.D.t.C.t.=.t
0x4f0701aa974b042ab74d066ab748064ab74p..t.B.t.f.t.d.t
0x500403aaa7490ad19777075a9745039aa74@:.t...wpu.tP9.t
0x510805ca974509aa974203baa749096a974.\.tP..t ;.t...t
0x530802baa74a094a97410141c77307ca974.+.t...t...w0|.t
0x540d086a974d07ca97430d9a974207da974...t.|.t0..t }.t
0x560b05ba974902eaa74a03baa74808da974.[.t...t.;.t...t
0x570a0a31c77f05f1977b039aa7420e8a974...w._.w.9.t ..t
0x580c0851b7700000000e481c67400000000...w.......t....
0x59010d249750000000030eb1776a0231876..Iu....0..v.#.v
0x5a0201b187600000000a04a1075a0491075 ..v.....J.u.I.u
0x5b000ba0f75c0571075c0571075c0cc0f75...u.W.u.W.u...u
0x5e0b04b1075d0b7117520581075308c0f75.K.u...u X.u0..u
0x5f070d20f7500e00f750000000000000000p..u...u........
0x600c8500000608b7d24fc816510ef000000.P..`.}$..e.....
0x6107507c7451001000000816514ef000000u..E......e.....
0x6207507c745140100000081650cffff1f00u..E......e.....
0x6307507c7450c400000008bc72b45248b4du..E.@.....+E$.M
0x64018890183c0103b4520730cff4d1c7c07......;E s..M.|.
0x650e805000000ebe261c9c3c745fc010000.......a...E....
0x66000c745f808000000e8e40300008945c8..E...........E.
0x670c1e0038945c4e8d10300008945c0c1e0....E.......E...
0x175800000000000000000000000000000000................
0x176800000000000000000000000000000000................
0x177800000000000000000000000000000000................
0x178800000000000000000000000000000000................
0x179800000000000000000000000000000000................
0x17a800000000000000000000000000000000................
0x17b800000000000000000000000000000000................
0x17c800000000000000000001000100000000................
0x17d8bbd2968eed0b938a82e4e9bcc3c53272..............2r
0x17e84c08aa569f2d640f1b86680e2b62e9c6L..V.-d...h.+b..
0x17f8356d75b6322d4fa8b8d92a448bf07fe05mu.2-O...*D....
0x1808d98ebe669da67a9a6de145f1d348010d...f..z.m.E..H..
0x1818392e9d2a45fb0bfb1d96f3b74f55e5e19..*E.......OU..
0x1828165bf7a1cc7c87c0c89cef4ece2958e2.[...|.....N.)X.
0x183899bd8a7a55beb41cd9795225d828867b...zU....yR%.(.{
0x18488139985f2c6f14bba56bce44e5919338.9._,o...k.D...8
0x18588b9ac1744684e126ec0494967509e3b5...tF..&....u...
0x186888d608f04ab784d3132f00ccd52a8c17....J..../...*..
0x18780709de6fb0d3d62bc6a69d38188c749d...o...+...8..t.
0x18888616d5486e9732dbe14ef804a6007c16...Hn.2..N....|.
0x18982e701c2337dd5a52766270d486666edf.p.#7.ZRvbp..fn.
0x18a80ce9a168f95ee8dd090c027d35d054e7...h.^.....}5.T.
0x18b800c0149fce4a9ff399501a0bcdccff05.....J...P......
0x18c8b90412e211762fffa46e6418e0d07b3b.....v/..nd...{;
0x18d8000000000000000083e0000000000000................
0x18e800000000000000000200000083e10000................
0x18f800000000000000000000000002000000................
0x190883e20000000000000000000000000000................
0x19180200000083e300000000000000000000................
0x1928000000000200000083e5000000000000................
0x193800000000000000000200000083e60000................
0x194800000000000000000000000002000000................
0x195883e70000000000000000000000000000................
0x196802000000000000000304240000000000..........$.....
0x1978000000000000000003000000030c2400..............$.
0x198800000000000000000000000003000000................
0x199803142400000000000000000000000000..$.............
0x19a803000000031c24000000000000000000......$.........
0x19b80000000003000000032c240000000000.........,$.....
0x19c800000000000000000300000003342400.............4$.
0x19d800000000000000000000000003000000................
0x19e8033c2400000000000000000000000000.<$.............
0x19f803000000505152535556570000000000....PQRSUVW.....
0x1a0858595a5b5d5e5f0000000000e0e1e2e3XYZ[]^_.........
0x1a18e5e6e700000000004c00000001140200........L.......
0x1a2800000000c000000000000046ff000000...........F....
0x1a3800000000000000000000000000000000................
0x1a4800000000000000000000000000000000................
0x1f9190000008b4df481e1ff0000008b55f88b....M........U..
0x1f92975f88a040688040a8b4dec81e1ff0000u........M......
0x1f939008b55f88a45fc88040a8b4df481e1ff..U..E.....M....
0x1f9490000008b55f88a45fc02040a8845fc8b....U..E.....E..
0x1f9594dfc81e1ff0000008b55080355f08b45M........U..U..E
0x1f969f88a123214088b45080345f08810e95f...2...E..E...._
0x1f979ffffff8b4d108a55f48891000100008b....M..U........
0x1f98945108a4dec8888010100005e8be55dc3E..M.......^..].
0x1f999558bec81ec6409000057c68500f8ffffU....d...W......
0x1f9a900b9ff00000033c08dbd01f8fffff3ab......3.........
0x1f9b966abaac68500fcffff00b9ff00000033f..............3
0x1f9c9c08dbd01fcfffff3ab66abaac785acf6.........f......
0x1f9d9ffff00000000c785b0f6ffff00000000................
0x1f9e9c785b4f6ffff00000000b91000000033...............3
0x1f9f9c08dbdb8f6fffff3abc7859cf6ffff00................
0x1fa0900000033c08985a0f6ffff8985a4f6ff...3............
0x1fa19ff8985a8f6ffffc685f8f6ffff00b940...............@
0x1fa2900000033c08dbdf9f6fffff3abaa8b0d...3............
0x1fa3934100010898db0f6ffff8d95f8f6ffff4...............
0x1fa49526a0a68f4e40110e87efdffff83c40cRj.h.....~......
0x1fa598d85f8f6ffff508b8db0f6ffff516838......P......Qh8
0x1fa69100010e83cfeffff83c40c8d9500f8ff....<...........
0x1fa79ff526800010000ff15201000108d8500.Rh...... ......
0x1fa89f8ffff50ff151c1000100fbe8c05fff7...P............
0x1fa99ffff83 ...
0x21bd872766963654100004f70656e53434d61rviceA..OpenSCMa
0x21be86e616765724100004f70656e53657276nagerA..OpenServ
0x21bf86963654100000000436c6f7365536572iceA....CloseSer
0x21c087669636548616e646c65000044656c65viceHandle..Dele
0x21c18746553657276696365000000436f6e74teService...Cont
0x21c28726f6c5365727669636500005f5f6800rolService..__h.
0x21c3853746172745365727669636541000000StartServiceA...
0x21c484e4f5449434500005f5f647200000000NOTICE..__dr....
0x21c58495046494c5445524452495645520000IPFILTERDRIVER..
0x21c684368616e676553657276696365436f6eChangeServiceCon
0x21c78666967410000000077696e25732e6578figA....win%s.ex
0x21c886500000025732e657865000057494e49e...%s.exe..WINI
0x21c984e45542e444c4c00496e7465726e6574NET.DLL.Internet
0x21ca84f70656e41000000496e7465726e6574OpenA...Internet
0x21cb85265616446696c6500000000496e7465ReadFile....Inte
0x21cc8726e65744f70656e55726c4100000000rnetOpenUrlA....
0x21cd8496e7465726e6574436c6f736548616eInternetCloseHan
0x21ce8646c65004156500041676e6974756d20dle.AVP.Agnitum
0x21cf8436c69656e7420536563757269747920Client Security
0x21d085365727669636500414c4700416d6f6eService.ALG.Amon
0x21d18206d6f6e69746f720000000061737755 monitor....aswU
0x21d2870645376000000006173774d6f6e3200pdSv....aswMon2.
0x21d3861737752647200006173775350000000aswRdr..aswSP...
0x21d4861737754646900006173774673426c6baswTdi..aswFsBlk
0x21d5800000000616373737276000041562045....acssrv..AV E
0x21d686e67696e650000006176617374212069ngine...avast! i
0x21d784156533420436f6e74726f6c20536572AVS4 Control Ser
0x21d8876696365000000006176617374212041vice....avast! A
0x21d986e746976697275730000000061766173ntivirus....avas
0x21da87421204d61696c205363616e6e657200t! Mail Scanner.
0x21db861766173742120576562205363616e6eavast! Web Scann
0x21dc865720000617661737421204173796e63er..avast! Async
0x21dd868726f6e6f7573205669727573204d6fhronous Virus Mo
0x21de86e69746f720000006176617374212053nitor...avast! S
0x21df8656c662050726f74656374696f6e0000elf Protection..
0x21e0841564720452d6d61696c205363616e6eAVG E-mail Scann
0x21e1865720000417669726120416e74 er..Avira Ant
⋯11 more rows
0xb1cd2617279000147657450726f6341646472ary..GetProcAddr
0xb1ce265737300014c6f61644c696272617279ess..LoadLibrary
0xb1cf24578410001436f707946696c65410001ExA..CopyFileA..
0xb1d025465726d696e61746550726f63657373TerminateProcess
0xb1d1200014f70656e50726f6365737300014d..OpenProcess..M
0xb1d226f64756c6533324e65787400014d6f64odule32Next..Mod
0xb1d32756c6533324669727374000143726561ule32First..Crea
0xb1d427465546f6f6c68656c703332536e6170teToolhelp32Snap
0xb1d5273686f74000150726f6365737333324eshot..Process32N
0xb1d62657874000150726f6365737333324669ext..Process32Fi
0xb1d7272737400014c6f61644c696272617279rst..LoadLibrary
0xb1d8241000147657446696c65417474726962A..GetFileAttrib
0xb1d927574657341000152656d6f7665446972utesA..RemoveDir
0xb1da26563746f727941000146696e64436c6fectoryA..FindClo
0xb1db2736500016c737472636d706941000146se..lstrcmpiA..F
0xb1dc2696e644e65787446696c654100014669indNextFileA..Fi
0xb1dd26e64466972737446696c654100014765ndFirstFileA..Ge
0xb1de27454656d705061746841000153657445tTempPathA..SetE
0xb1df26e644f6646696c650001476574507269ndOfFile..GetPri
0xb1e027661746550726f66696c65537472696evateProfileStrin
0xb1e1267410001556e6d6170566965774f6646gA..UnmapViewOfF
0xb1e22696c65000153657446696c6554696d65ile..SetFileTime
0xb1e32000153657446696c65506f696e746572..SetFilePointer
⋯4 more rows
0xb1e827374726c656e5700014765744c617374strlenW..GetLast
0xb1e924572726f720001476574447269766554Error..GetDriveT
0xb1ea279706541000148656170467265650001ypeA..HeapFree..
0xb1eb243726561746552656d6f746554687265CreateRemoteThre
0xb1ec261640001577269746550726f63657373ad..WriteProcess
0xb1ed24d656d6f727900015669727475616c41Memory..VirtualA
0xb1ee26c6c6f63457800014372656174654d75llocEx..CreateMu
0xb1ef274657841000148656170416c6c6f6300texA..HeapAlloc.
0xb1f020147657450726f636573734865617000.GetProcessHeap.
0xb1f120147657443757272656e7450726f6365.GetCurrentProce