Extracted

• • Target
    2026-06-25_e4ea9e98354179b72f3c626f6b9c7d9e_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_mespinoza_njrat_remcos_smoke-loader
  • Size 3.1MB
  • SHA256 5fd40997ea56eb4556bd105a2812bf82ad85cb44e1645d1f2a9c47a237aa006c
  • MD5 e4ea9e98354179b72f3c626f6b9c7d9e
  • SHA1 f720ba47cfffa8f562b76b0ed2ac84e1f076cbab
  • SHA512 ffce5cd644a28f7bcbb210d5b2cd0d4c2a33dea23ff1bc174d503309284c9af9f2b97afc819532d029112591ce72183dfac7609d52399c192a24fa82dbce28d1
  • SSDEEP 49152:tII460TK5gE0PojzgHfuVmxrDMhzMQ5P7ti5sKvDsBrZ0g2nMl:qI43TK5gEBj4TxsltiZv4L0Gl
  • TLSH
    T198E5C002FB4284B2E883093151A7477B4975AD306738D5C3D7A239395DB12D2BA3F7AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2