Extracted

• • Target
    2026-07-23_45dcf53e4cf7724d44489d19206f5e7a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 127KB
  • SHA256 ea1bcd28686a8359692a4eb2505fe5619eb4e99fb79b6833f544b76d2c417af0
  • MD5 45dcf53e4cf7724d44489d19206f5e7a
  • SHA1 6313efcc299699fd48d82280bb40998833405b06
  • SHA512 8ddf549fd15678021b464192b2048c2a5e18e63cfc7cf56dba0884510d73f20220b04bb5c925529ee7553ec4720ec7551fa48f6d223295cf6df929b79deea60c
  • SSDEEP 3072:nIDSbca7C7IRJD7cfXVMQP2PcoGX4cJAbol:nIDUc+UXVMqoGXdl
  • TLSH
    T142D3E1153640C03AD42661744829C6B18EBFBA3616B6D5577FC81BBF4F323E9EA3530A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2