Extracted

• • Target
    2026-08-14_dd3358cedeecd07772b0532887a81bde_amadey_darkgate_elex_glassworm_hijackloader_maze_smoke-loader
  • Size 640KB
  • SHA256 b5badb00b6ad3a7c690e096aff7aafae828ee04d0f460a96ccaf75746e9554c6
  • MD5 dd3358cedeecd07772b0532887a81bde
  • SHA1 4979cfad480237a7d26f05a507d14bda04571a9b
  • SHA512 d62cd4d2758a713a807414988c2dfa996d8bdcc6718441113cc1e6d75ffdc12a00f3ab05c0c759fa1ab0af1d04923866dc0e813e731f913aa464e464c45eab96
  • SSDEEP 12288:QIG0t8gIXaaxsGB5UXxRvid16eGDF4lYU0HvBoujZGVRBBuZs:HGgT6KwqifCAYU0HvBz8qZs
  • TLSH
    T1DAD4C021B762D131F9A201356AEC8AF6593CBD31675580D373A53B1E9E216D0EE3CF22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2