Extracted

• • Target
    2026-08-14_096711e34593082f9746c33e5447f69a_amadey_darkgate_elex_glassworm_maze_smoke-loader
  • Size 632KB
  • SHA256 7e888351ad051836f86981e3fe3ae84691203ceb86e0ec41fbc44a2bc542ddd9
  • MD5 096711e34593082f9746c33e5447f69a
  • SHA1 5546558d9e0e720b4859f57e10ebe5b774bbbf29
  • SHA512 e3228f53663068643fac251b5cd8ee5fdf334854cf797463fb2f7a86b08d5182c4b6e1e7c38a6d163fe3b524bb5ebe27f0fdb295a82749297d1dfd44d8047d03
  • SSDEEP 12288:tIQ0tcg+XaaxsGB5UXxRvid16eGDF4KYU0Hvw69Q:+QgzkKwqifCjYU0HvwJ
  • TLSH
    T1C3D4C021B761D130F9A200356AAC8AF6593CBD31675680D773A13B5E9E716D0EE3CF22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2