Extracted

• • Target
    2026-07-20_02c0190613794d68f9688fc0e53f76f5_amadey_coinminer_darkgate_elex_hijackloader_luca-stealer_njrat_smoke-loader
  • Size 1020KB
  • SHA256 f08ae1f65397b9c6b049fabcf81a558cda28b138f89816afcc73f2bfd8ad8854
  • MD5 02c0190613794d68f9688fc0e53f76f5
  • SHA1 1551eeb102eb5d1a1df0db32c175f8517dff6aef
  • SHA512 22e88ab4b52042d0204aa96da7b9c6837c2e6606923bb29d3fb988c7262f0991d42d91f3323ecdba60d2f180afd3c8e18e5312a7917dda640dffe947678e97c4
  • SSDEEP 24576:UYwSAXEHQ5NNYbD1yobQ6wgDk3IQknvkW2B9ZMmcykXoIoAIC:/wSbPDkHknvX8ZMmnmXIC
  • TLSH
    T15F258D607662D233E56185B24E78BFB7906DBE280F714ADF63C4173E49355C22E32B26
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2