Extracted

• • Target
    2026-07-22_208345399f4c83d75c89610746b06b40_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 127KB
  • SHA256 ec3b199717d0a35b22f7bf1e278565133a79cc195fc144d2fa0986723221611d
  • MD5 208345399f4c83d75c89610746b06b40
  • SHA1 b18103561e7a32bfbd07f9616b39bccb18e8a1e7
  • SHA512 34a59318375263c80c9ecfbb039a66c0941da96268bd8e71d1806b261ad6dfd4690842776cae9452a7044565c3b8c56ec2824add149eabcbe13df7f2687aee2e
  • SSDEEP 3072:pJHLlDVzRoLOUppm78S1KslBnbyVwIQjuzipIkd:rHLlD83M8S19nbXI6uziikd
  • TLSH
    T18CD3E1027991C0B2D11195B818A6DA616FAF6C3027D6548737CDB2AF8F322D3D23A75F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2