Extracted

• • Target
    2026-07-11_3ac53a68f9ca06bf26c688c0bf88d86c_amadey_elex_rhadamanthys_smoke-loader
  • Size 116KB
  • SHA256 e0666891d2ab5eb27725f2733564bb1d18daf13ef5df631d5ab25cc7582f84db
  • MD5 3ac53a68f9ca06bf26c688c0bf88d86c
  • SHA1 c3965f78a7a87da3e8ba384d192657c719b6a1b3
  • SHA512 e75c035ff8568110a8c4886bf89e3a3596c89683b7445ed39e7d0e3373af1f36808be88f6e0625c6ce33a07b8d290ee440351b79b731fe1ec30238d740b819c8
  • SSDEEP 1536:nDz6TvoQNzHOcR0TUSLJSW1NlJqfg9FGwTCw0r46ck+Mf4lq3ucZfp2i7pyM:nDzcwQNO71Nlywuw24C94lq3zZx1p/
  • TLSH
    T109C3E10238E1C571C44B85B61B65DA06A777F40747B687E72BDC578DBAB23806E3E382
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2