Extracted

• • Target
    2026-08-17_6fe23f2000da9da205bb9ded8d8000c4_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 127KB
  • SHA256 281b4447a6e346cc7e7c7368a7422f285493ed9a880c6eb6d773be4dcef1e0e1
  • MD5 6fe23f2000da9da205bb9ded8d8000c4
  • SHA1 1161cfcc7923ca455a80fb547d1f1ad8f7215772
  • SHA512 18b132bc951bd5c90491092c3985026f8da14e8eb233fd04785608d7a1c1f553f0cd37c795f480eaa11fa2b48167138b4e7ba0c241b2589ebf2aa9b3a1443504
  • SSDEEP 3072:uYDSbca7C7IRJdyVyhdBEH/MRUW2UpU+dCJxx8aFQ8RXn:uYDUc+dyVyhdBEH/EUCU+oJxx8AQOn
  • TLSH
    T1A8D3D0253941C036C51261B94825C5B18B7EBA3106F68987FFC44BBF9F733DAA939386
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverybackdoordefense_evasionsalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2