Extracted

• • Target
    2026-08-11_be6bc83f30d34675b301ea74249d131c_amadey_elex_hijackloader_magniber_remcos
  • Size 422KB
  • SHA256 ce2c9f2ab04c0a39d9f03aa45a03e88837909dc39100eb6f4862cd88d953106a
  • MD5 be6bc83f30d34675b301ea74249d131c
  • SHA1 6a8632005296e19ba3312eb39f068aae30d71d45
  • SHA512 91611c1b949721036ed0395d424ae4004fc4210d31f84add28c9fb567979e2e89aa7f81daf509856719146ecd68082fd3b72e37fef7bd8dd8d4475006aec17d1
  • SSDEEP 6144:FLcvVsoKBlr25QGG/jzKV3u1nxb3T9tw68EWqXUy5xedA:+GjBl25nG/jzKV3u1nxrT9tmEWPdA
  • TLSH
    T183949D207E42D132EA921132967EDBB1497DA631171B25CB37D80A3A1FB07D2AB3535F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2