Extracted

• • Target
    2026-07-03_4c5c3504f4e49c6f826c3ee62ac1614c_amadey_darkgate_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader
  • Size 866KB
  • SHA256 2f02df8a4a23c9b009facd6d54a7fdae0cf02ad553b9f0c08c3aab785852252a
  • MD5 4c5c3504f4e49c6f826c3ee62ac1614c
  • SHA1 96fa1c9fedaa99fb7b2d8e02b67fbb1fbe80657a
  • SHA512 b0318f72ef975ae8b10fbad9ed5178dc502648ea51efbd025a3f726ea4a9e192e958e8a9b70f9d4c67ae136f3434c5455bb4714565ce3fc90dea553574eaffab
  • SSDEEP 24576:7XA97tivrR4KtGrE+FBgEOk1ZktDORCi9L9d7v:7XA9W7tG7FdOC0DOHLv
  • TLSH
    T1CE159E32BB81C432E1A200359578677A5BBCB930072656D7E3E5067D2FB82C27E3576B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2