Extracted

• • Target
    2026-08-08_4c9708b43dba6e17532c2ca50f3508e7_elex_stop
  • Size 623KB
  • SHA256 bdff05da6b1f8c6f62ac8ec08582db5c6496dcc571d92c1511a573530480afa8
  • MD5 4c9708b43dba6e17532c2ca50f3508e7
  • SHA1 6e34c24de736bcff7a568191e7d21dcb61b0b4aa
  • SHA512 a21acf94f278d6284a954410d225330f5322a9ae299cdd443f769b522af2ef1156478877673814a70109310f75376a9d0327da92037c6179b92e7e4e214ae4fd
  • SSDEEP 12288:mMl23+mvm27FPL/Nr5IpNL9KEiLQXCsqn6eVhFnvtdn7DnQemX4Km:mMl23+mmzKvLQXCs+6eVhFvuX4Km
  • TLSH
    T158D4BF1279D08337E24652BA8B13CB6B1AB77CF41468944BB9D036B93E34352E72875F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2