Extracted

• • Target
    2026-07-02_bb26c3af2610525cf069492fb8409ee8_amadey_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_redline-stealer_remcos_smoke-loader
  • Size 2.6MB
  • SHA256 bd8aa070337c63ec952d84a57a5ef2690f5bba849490dfa71bb4e133bee54210
  • MD5 bb26c3af2610525cf069492fb8409ee8
  • SHA1 4fc7c52bd5f6480e85a619cc11873cd04d3da0c0
  • SHA512 d616148bf5a4bf1e0e81a8e91bfa7286f1550d246dfc9205ccf630b150666e2c7e245083898ed43d5c06e5ae1b995458cdde82aab3ebb32272661a66a3048c1c
  • SSDEEP 49152:2FdGAmsu4sVrFpdrDLR8sL2GRQYLd6CnykKi7NrZOPEC5LQrHc9ffQ4W:2FdGmutrjdz6shhLdvx7NrZJKQrHc9fk
  • TLSH
    T18CC59ED1B7C1C272E6C1053956BA4BBE99359A30532894CBDB8335364E703C2AB3D7B6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupxadwarepersistenceransomwarespyware

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Windows security modification

    defense_evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2