Extracted

• • Target
    2026-07-31_939e9d6cbef190218081e160f359f5d8_amadey_elex_rhadamanthys_smoke-loader_stealc_stop
  • Size 1.3MB
  • SHA256 c0415606486d729f69bb47c53907c79bba089ceb6f90524ed7fb0b336117377e
  • MD5 939e9d6cbef190218081e160f359f5d8
  • SHA1 e1986c3936ba3d82201c60088c832e8710d96ec3
  • SHA512 8b43a98403e492d7e658bda5d8d8bec5c22c949309faec8958c98ff5c892d27b9b3d113092ca50de2a4deb9d6023dfe1dc5750ff6a8e77c8c4434f25e66c08a9
  • SSDEEP 24576:FUksqjnhMgeiCl7G0nehbGZpbD5vgIsqjnhMgeiCl7G0nehbGZpbD:FUADmg27RnWGja0Dmg27RnWGj
  • TLSH
    T1695523B9750860ABCC324875C3D5E16DA80F7D62992058437A5778FEFFB64A48B3D0A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionsalitypersistencespywarestealertrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects Reflective DLL injection artifacts

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2