Extracted

• • Target
    2026-07-20_5d15f6c036e71f580d26efcbb306b055_darkgate_elex_glassworm_hijackloader_icedid_remcos_stop
  • Size 2.0MB
  • SHA256 a5a2ec0938acdf2cddef8e6eb10a879be96481f4223ceb910fe284a89b8d13ec
  • MD5 5d15f6c036e71f580d26efcbb306b055
  • SHA1 92910f83a042f54b11168c7977e1d36fb7c06cce
  • SHA512 c7b4b87c41b0865752586a48e04db2c49af965eee9309fc64c86c03759dc28c5c93671584d1466d218fcc952250cf90bff77d0fa7e2e66d3a7d4106a21d79d31
  • SSDEEP 49152:hM/74Gtx2qQgxZQcciXhj07qmcjdL3kq6JFhbDEgJ6u:0B2PgxqYXhA7qF5
  • TLSH
    T1C7957E2376D9D837C31249B28AECA396D3A5B9303B3541433948EE7C8FB41E19A55E37
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2