Extracted

• • Target
    2026-07-29_3997ee85ee5c263fce6551c805efd6d8_darkgate_elex_glassworm_icedid_remcos_stop
  • Size 5.8MB
  • SHA256 4fd69d9d4e44066197d4131f10929984cd1928e1e3c9cded389e889844424ee8
  • MD5 3997ee85ee5c263fce6551c805efd6d8
  • SHA1 7f6e534ee7f5756af0ebef73a0b1286025613fb2
  • SHA512 7bd6eeb82c7f935fcb869d361e217bf5105867148242cb10b1723ac566cc2733e352ee8dd6bd86574393aaf438aea3e981b0e31f5dba437caadd0cdbc76b5e2d
  • SSDEEP 98304:pq3aXe/hpJrHQzP4vs18frP3wbzWFimaI7dlo4Gh:De/hpxwCgbzWFimaI7dlvi
  • TLSH
    T185569D51BF8C817AC95A1531072DAF2A402ABC94773465D3B2B43E7EDC763C26C3A61B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoordefense_evasiondiscoverysalitypersistencephishingspywarestealertrojanupxgoogle

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan
  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Custom signature

    Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Custom signature

    Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • Custom signature

    UPX dump on OEP (original entry point)

  • A potential corporate email address has been identified in the URL: [email protected]

    phishing

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Detected potential entity reuse from brand GOOGLE.

    phishinggoogle

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2