Extracted

• • Target
    2026-06-30_d986897fa35f5f43b40de246bf6aca87_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
  • Size 134KB
  • SHA256 ab06cef6ebca5f0a425373c08cea4aa81093391cb3f22ee8e9b2448b39349536
  • MD5 d986897fa35f5f43b40de246bf6aca87
  • SHA1 504b66be4e7f7970125283945dfcdb7fd07451e7
  • SHA512 70766cfb440fb0fe15180aa91c498266f474613a77e3cd03165cfc3690b06f10a8dbc3794a7d98df066f4d861841a7839a7f4887ffea22bfef075a8e32a24b6f
  • SSDEEP 3072:ONGTd3P2ALCjkf++XFhyZ5HeTgnzEpNUqcj5Hm11NABuDxTUvdCz:0Q3DLCjkfzwGU/lmfNABUTUYz
  • TLSH
    T120D3D061BAB1D032C4C24531891CC2F18A7EB8321AA5C947B7984B7F5F707D4EB7A35A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupxadwarepersistenceransomwarespyware

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2