Extracted

• • Target
    2026-07-27_fbb9a4893732db334a088624b9499900_amadey_elex_smoke-loader_stop
  • Size 423KB
  • SHA256 b44dbb7d2ada8acb496291e76a3ac1c0eb90c12103367c7d4bb7f588f54f6d80
  • MD5 fbb9a4893732db334a088624b9499900
  • SHA1 450354564325b5239fb96c55a66cb7e6cb1ab256
  • SHA512 6523f97857aa3924cd5b0e3b14ceab6186cbf7cb7115a79e6707e175dffdc27c92d22039bdc484760ab7104ed6fac0b176b0b6e0ff011eaa43348645f25f0332
  • SSDEEP 12288:01+b2NFYAeXX4e0ne4F2rnX9oX732KgeH:s+bcq0e4FCNoXlg6
  • TLSH
    T11E94391277F58035F6F32B31AD7582714A7BBC61AD39C20E2390262D5EB1A90DA78737
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2