Extracted

• • Target
    2026-08-05_24520e6287eece27b231bc3f15674cb3_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
  • Size 268KB
  • SHA256 ec553d70fe8bb863576d1da70fdd966c7b75009ac01205c9a841d7e750495bba
  • MD5 24520e6287eece27b231bc3f15674cb3
  • SHA1 980e4340e1e91e6b1829fdc8cbc2459be73dc282
  • SHA512 a74f1ad48428f8a6a34e82718f8e49eec6a44bfb80794e0dab1be7760a6912229faf6b8f90176d852550b5036d799551d1199b3f2557a31fb4fd37b35f08af2d
  • SSDEEP 6144:GAR8D6lpYMqi/N8zWdOZSmE2CR8Y6lMAR8D6lpx:GlD6oMn/N8TS/2fY6mlD6h
  • TLSH
    T1D044BE22BA52D032D4114971046AD7926A7DFC321778D9D3B7963F7E0E323E1E63A70A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • Modifies visibility of file extensions in Explorer

    defense_evasion

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2