Extracted

• • Target
    2026-08-04_fa5d74ef030dc8730254d1c0b3c64e5a_amadey_elex_rhadamanthys_smoke-loader_stop
  • Size 134KB
  • SHA256 2645abe8cae86fe0e704b8ea05552977b330b57f78258b578aea0a7d4be26ef5
  • MD5 fa5d74ef030dc8730254d1c0b3c64e5a
  • SHA1 77abe644d7e665b64c48386b5d72d3ea2d98862e
  • SHA512 aa9cf2b8c825539f53e8557a52c21a0fdff4c2d2a738568c2751b279d5602d3b1ddba3dc4bebb8dd38bbb8e0b833eafe2c5ed1a28b7fa44b9772d8513e472c04
  • SSDEEP 3072:jUTKOhQ5jlx2AI+51IOK6ndmauvifg4rmJQ3t:nOuLN2p6nMVvegNJQ3t
  • TLSH
    T194D3BE2A3C57C033E8454EB182D5C2D2AFFE2D1339AB907FEF9405891DD5288267A6F5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2