Extracted

• • Target
    2026-07-19_5dd3b467e7a281865531992afa106146_amadey_darkgate_elex_remcos_smoke-loader_stop
  • Size 728KB
  • SHA256 ad4456aa728955ce461f482314bf9696a92f5c74ce4bf5b888c7ac3088a82859
  • MD5 5dd3b467e7a281865531992afa106146
  • SHA1 229f3b0b5d7f58a55a4c0882962b37977506543c
  • SHA512 54bc8e814c1a600726f637259e2ad7f721b3f44eadb7c9c1a4997cb7c4e12c07f6674e8d6cad569ccac3952e78cffe2a5a5d86b87d296c35398b84e03ba9b216
  • SSDEEP 12288:I7fpQzjCYYpVid9colSor7BvXqAWMYole6wSIlqQkMMN:Pj+i8oJvXq9ole6wmQkMMN
  • TLSH
    T13DF47D13BB95C0BCD92418345BE2AA7129BE3A3FDC341A9B71C8361DA9B1193513DF1B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2