Extracted

• • Target
    2026-08-10_a8ed87d5587a36eb5009a07694da438b_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
  • Size 6.3MB
  • SHA256 3c3b88ed05662c7541f0a3ac015673a44d83f04df9bf2586dfc3be35b9c9ac74
  • MD5 a8ed87d5587a36eb5009a07694da438b
  • SHA1 c7893ec2baf4f6ddd2f865a37f9529f0ce6c33f5
  • SHA512 5223bd8a38e227683897c483e3308d8e2e0660128afffe435f46f0fe33d522fbb2ce7d2c14413fe29f4eebcdac05dd5a21f5fcd28106e1e363e00cad178b0828
  • SSDEEP 98304:94QeMyLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22ImljBV:tefZF6bUpMBF1p/kjRm4OWi2b
  • TLSH
    T1F2663329AC864172C277183248B2D6712A753AF60F2854674FD52B3F0B725B17E3F8B9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypyinstallertrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2