Extracted

• • Target
    2026-07-22_c2100ceeab4343c525f23c4062be0368_amadey_elex_smoke-loader
  • Size 667KB
  • SHA256 efef3f89e0ef75d633dd076a1266bee67c9e9c54210a41610f12018ad73efd9d
  • MD5 c2100ceeab4343c525f23c4062be0368
  • SHA1 24afbe1e7e40cf1afff860f9be826356843e8d09
  • SHA512 ccdf192920185419a61e3d0c69fa537d4ab918ef1f02d0efb896cf618b81775e4b922e82e2a9c0e7fdf292a9b9904e5a778f96e92f0146bfc64605123d2386f9
  • SSDEEP 12288:lBqpT+sxQPel7xZ6eOpd8bAytBF0dubPD4svNrfsw9cW+mvdt0hN5yIQR:lBETxqeldup7mA8b4Urfsw2W+Gt0hN4v
  • TLSH
    T1FAE4BF21BAC0F0B2D5A332F0CA11A7625EFABD3169254287E3D8271D1E705D1EB39767
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2