Extracted

• • Target
    2026-07-02_cfa428711584b02b3fe41a2d43f9173a_darkgate_elex_remcos_stop
  • Size 956KB
  • SHA256 5df7ea4b8cc8e89ca4641488e7322672c3a859fae1e2bf6b95144868168e0969
  • MD5 cfa428711584b02b3fe41a2d43f9173a
  • SHA1 6655d12884ec8d05a4b9143b9fcc509ea0834f58
  • SHA512 19328cc178a86d03f30ecaf85f451f221f1e382ae4f81c8e032ea19f3464f8a3fc1ef96f1d26783c4656fd6f8f75a05cc035bc94c1b01a6dc210c3ff52bd3a18
  • SSDEEP 12288:wIDmEcDhvCUMoUlKJwB0cn3Fnd5+yUoNPTs2JQml9FB7GcPQdYm1qIIf0P6a0/KX:w4HoXcvtNPAeQ8FZQdf1qIWeOmuF+
  • TLSH
    T17B25BE00B782D036F9B314F18AFE866E9538FD21071554DBA3C8696E0E75AF27D3126B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2