Extracted

• • Target
    2026-07-15_d81a65c641ca0d703eacd512fcf1984e_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
  • Size 6.3MB
  • SHA256 3904ee0c81b48dc97f0356f325048c29d3bca02dc563441f7a91e7a855f5c8a3
  • MD5 d81a65c641ca0d703eacd512fcf1984e
  • SHA1 bff6ebe287f89ed0c68cf006fa004ad812bc2a47
  • SHA512 a0fef0ff35f4442e343b5b8d8c3bf97b626dbf5e5794d2ba2d656aa1496c743fe72eb0d2e186590043cffccf28d423e7b75cc7ef3f68ae321e4f6ac04c554bee
  • SSDEEP 98304:V3QeMkdLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22ImljBV:yeJdZF6bUpMBF1p/kjRm4OWi2b
  • TLSH
    T16E66331AAC864272D233183248B2D6712A793AF60F2954578BD51B3F0B735B17E3F879
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypyinstallertrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2