Extracted

• • Target

    2025-03-30_9527b1fa9ca9e865e31bb709e1f838d0_amadey_rhadamanthys_smoke-loader

  • Size

    170KB

  • MD5

    9527b1fa9ca9e865e31bb709e1f838d0

  • SHA1

    54b3cd9b80bed7353a4e1ff1ea6e52748b0c71b6

  • SHA256

    c3f9b9420cb8895f06fb5c6a81f0e9ba9de433e77bdba8db845f00919f1afda8

  • SHA512

    0d20a320ff196d8c47bf31dbf142074371eecff994b9a2167368d305648f3738ebc74625f816b4a854a27ac5ac7f37154ee738abb717ae4c8b44257edafc8ef5

  • SSDEEP

    3072:GrR856hD7AyQIrZBbSJneVmSgyMp/nLA3PXv37et5+/QxMNWHwBarSwfG1ETK5u:GrR856l8Y0eVIyMp/LAXrW5+/QxMNWHN

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Modifies visibility of file extensions in Explorer

    defense_evasion

  • Modifies visiblity of hidden/system files in Explorer

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2