Extracted

• • Target
    2026-08-10_5d1505e8493f08c748184b84920c1c8f_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
  • Size 6.3MB
  • SHA256 50d4f9ff0a3b9c5d1fc0c1c38941d2bbf2622a2a700d160bd2e23653f298af5a
  • MD5 5d1505e8493f08c748184b84920c1c8f
  • SHA1 db11ac6f2910f6c80ff5ec9f29c669bb4897dc9c
  • SHA512 2b22326752990d5c0dd56945e91807e5630d4623db9417050934015ce88cddde1eeabb0b3b9f1d808b444dd80567a1d28fef71c1bab0eb2588e938667c76c28a
  • SSDEEP 98304:0BQeMeLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22ImljBV:TebZF6bUpMBF1p/kjRm4OWi2b
  • TLSH
    T17A663329AC8641B2C273183349B3D6712E793AB20F2954674BD51B3F0B725B17E3F869
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypyinstallertrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2