Extracted

• • Target
    2026-08-01_a1027451b24e1b35e490cb2cfda00103_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
  • Size 6.3MB
  • SHA256 709efc0636ca73270331dd6b0549581dd17f9b6f273a884dfb64784636a8f687
  • MD5 a1027451b24e1b35e490cb2cfda00103
  • SHA1 35cc1f4eeebaaef034f154e899bdc1b4efe07feb
  • SHA512 d2dece8b7232d420245dbc12d3a4a208c0d3250f13978ef7855007beaa1abcb7292832cdc5e2f2e1671ada4112254aa138fad2bd0a2ce8746976b491e1a694c6
  • SSDEEP 98304:tEQeMcLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22ImljBV:le9ZF6bUpMBF1p/kjRm4OWi2b
  • TLSH
    T10366332AAC864272C233183248B2D6752A793AF60F2954674FD51B3F0B725B17E3F479
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypyinstallertrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2