Extracted

• • Target
    2026-08-08_ac6e9282b92761e48b7a1903bbf579fa_amadey_darkgate_elex_mafia_remcos_smoke-loader
  • Size 6.9MB
  • SHA256 46d3f60425fafb2f8e07235fe464090fc2e185ddddaef1269e68b3259d561faf
  • MD5 ac6e9282b92761e48b7a1903bbf579fa
  • SHA1 c15cac3a50a1e1a76c9115472c9fd71eeae6b2b8
  • SHA512 636f8d828baf07a927283d02b63ce850f161fbfb3ed9d181f0454d315a3777c5650527734e0924f19df78531352c6de04c6d8895687e203673efe78284fb799f
  • SSDEEP 196608:erTihZIH58eoehqIBWKUsb09h1IMSzYjnTdi:WueBhN5bsoIBi
  • TLSH
    T1E676220273EB8136E1FF16301EB6D7B687B9BD719632C10B63A42A4D5E71A41AD32713
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2