Extracted

• • Target
    2026-07-06_a5cd2b4fb982c431d306cb6540cd2c95_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
  • Size 974KB
  • SHA256 14b0c214af1a40a6987d4756f0622552885afc69ec4f31651109471612186635
  • MD5 a5cd2b4fb982c431d306cb6540cd2c95
  • SHA1 915f1257fa790b958cb2cede3fc6e10dcbadc62e
  • SHA512 ef88d87a769f56baab87f0a660f18f177ab37a87a60176dcafc6e235e8ef9e4b67ead1941ecde9272ac82ba93a69e3e22e58c374b2a14491da2018a85ab6f81d
  • SSDEEP 12288:GFY60aUzs0gHCSL7FkTaSKYwN33QY9nDXruPHGtY59Ojc4Y1p7jLdC74Rq:+l0gHCSdkTYwMzaG+59UY1pHA0
  • TLSH
    T148252322B343D170D4A15C3555068A42A62CBD344B29EF53F3C47E297F323E6EA19BA7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • Modifies visibility of file extensions in Explorer

    defense_evasion

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Drops file in Drivers directory

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2