Extracted

• • Target
    2026-07-04_ecaa417148fdb4e02430958655adaf1e_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 194KB
  • SHA256 cde0bd9da0a7064f3c58ff13f48cdb65867f956875c054068d87588fa14e1d20
  • MD5 ecaa417148fdb4e02430958655adaf1e
  • SHA1 e010223a3dad4872799c29c402fa6684bfa932f8
  • SHA512 14faff176e36e3186cd83d4590004efc880ea10fc1948cecdc3963eb1c2f11df0d85e10c05ab9873fbd00749e6c19c8d6ad04b3dd49ac3dc6c610d2466fb47a7
  • SSDEEP 3072:UdLVpImRqLOUph/WD4+NlECExICmZrhqzU2KqHvnwX5c6LsXS5QRNd6:KLVpOjclEpCx91Vo65HISoN
  • TLSH
    T10414F115F648C471E41225B91066D3610B2BFD252BC29ACF7BB6B65F5FB22C2823731E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupxadwarepersistenceransomwarespyware

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2