Extracted

• • Target
    2026-08-16_2c7d89f0a556c10a6cbf7288787a7452_elex_emotet_glassworm_hacktools_remcos_xiaoba
  • Size 3.1MB
  • SHA256 aeb84770fdf30755c9bb5dff73a22329002a1800e834b7e99470252127862a98
  • MD5 2c7d89f0a556c10a6cbf7288787a7452
  • SHA1 5fa4538ef151d6abe50db474f426555916eaae4f
  • SHA512 d67bff5e5cc648d54b8b736fb66cc5ae5f5e7dfaa0c9c8372f26b007a32e9ec3604e6b675b24cf68ad79c037e71df7d9972d319e9d7814d26d91fa8fa4282405
  • SSDEEP 49152:Ni38LAQX1am6fnVlG423oec27uB48ROuiQzVnYixYLR686UYVEQDpwwNk9:xb6fnVlG42YMaXzxmLjHl9
  • TLSH
    T143E5DF13F242A066F00C1274A379573D68B56FA109294987EFE4FEFC6F766218AE350D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionpurplefoxsalityrootkittrojanupx

  • Detect PurpleFox Rootkit

    Detect PurpleFox Rootkit.

    rootkit

  • Family: PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2