Extracted

• • Target
    2026-08-10_e616f7383ffd46a5ad7fa985e88a0916_amadey_elex_rhadamanthys_smoke-loader_stealc_stop
  • Size 185KB
  • SHA256 506465eaead3f95e939a64d3afacca4709e289b742693314347e1a4169a15e34
  • MD5 e616f7383ffd46a5ad7fa985e88a0916
  • SHA1 c630bf4be4db9b29d46cca7f3bf31a684a258bb5
  • SHA512 b63e984155ec67624bee477c0c7d9b791b9f288aecae9f669346aabb24c547ab529232919f678e2d17d49ff610bcf076d9153b0c2d8de1ee415fcd58b335cef7
  • SSDEEP 3072:Rv5hm7VmBP7PtReQJU7MLgE85RXOgmG3lfCEEBbq0C/UgEPbbbD:p5wAJyQJUMLgEkwnB10UX
  • TLSH
    T14D04E0613D41F43ACC318875898A86A4525DBC32A673E98373593AFB3F701D1B9362E7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionsalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects Reflective DLL injection artifacts

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2