Extracted

• • Target
    2026-06-27_d75a2b7558ffeef8c281cdd4fb3e4996_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
  • Size 6.3MB
  • SHA256 15792b3814a9caeaa1b83a00c856035f4e919e86f668eb95d51c073a581217a9
  • MD5 d75a2b7558ffeef8c281cdd4fb3e4996
  • SHA1 d51e8a9c6f6596ae2b8b88e348a41daf03d37b77
  • SHA512 c5270e4ae727a6973a844a5f91ac402090b76a51c223e864f61ab3829d54eba898815dffbbb0cfa23810c86cf85ab19da062f1378f4aa8e4501f1388d89c02a7
  • SSDEEP 98304:dPQeMSGLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22ImljBV:OeFGZF6bUpMBF1p/kjRm4OWi2b
  • TLSH
    T14466332AAC8641B2C233183748B2D6712A793AF60F2854674BD11B3F4B725B17E3F479
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypyinstallertrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2