Extracted

• • Target
    2026-07-20_8ab115089133d1b2e635063b39cc7f46_bkransomware_elex_hawkeye_icedid_maze_remcos
  • Size 474KB
  • SHA256 e3371bb161aff6babf1c6e0623ff8f9f64a885d3a78e0fc0eb6d7ae6d0f8599b
  • MD5 8ab115089133d1b2e635063b39cc7f46
  • SHA1 acf6a4b3ce6b612c376fc34d12650a8c23e75fae
  • SHA512 3e289a160cdba711e819b5e9c79fa961a544cb3b769b6e098fdd1daaa8175bf8278398f6f243afbabcf4753cf7d75e14b9b7b942d653218507b5fe1098da662f
  • SSDEEP 6144:BaUSeyqj6ztvrfMqBODlRC8r0Hg77nyihK6cO40YFl7nzkrVJlK/tacg:B/SRvAMqlRPrIg7nIIwnzmnwQcg
  • TLSH
    T1C1A43A0277F99035F2F31B31AE7992654A7FBC729D35C20E23942A0D49B0990EA75B73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2