Extracted

• • Target
    2026-08-16_e5bcb55a6660de34363e98565c14dba3_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
  • Size 6.3MB
  • SHA256 79089f2aebe2fbda5235396aa919b9a156088cf8806fdf87a2af4a0272e1a4d0
  • MD5 e5bcb55a6660de34363e98565c14dba3
  • SHA1 ab7beb09a44cbd16e29711ab7e5e5467cbf731fb
  • SHA512 c55d1286762a784ea7515814ed043c025ff2cff3c1dcf52212bd7a0f1fc50afcdfc6bfb2852e8d8dee0abcd55f73e49f9623368d94e0e2104d79e8ab2c3d6556
  • SSDEEP 98304:LlQeMiLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22ImljBV:iebZF6bUpMBF1p/kjRm4OWi2b
  • TLSH
    T1AE66332AAC8641B6C233183348B2D6752A753AF20F2954674BD51B3F0B725B17E3F879
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypyinstallertrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2