Extracted

• • Target
    2026-08-19_c2c39d0281437ab9d41aa0f11bcd2b4c_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
  • Size 2.5MB
  • SHA256 5df8666c9879f33b3edb9bbfa2b3c92c262e3a5dd180ae2b60ba87a404e5d6ce
  • MD5 c2c39d0281437ab9d41aa0f11bcd2b4c
  • SHA1 69a60b3ed331b1f4b18207f04125d0fce011aee0
  • SHA512 e370bd0036aee9bab0408292d54eb9c49fb3c16bba8dd960ad440e08a954a9790cdfa4b75ad3fbb54fb13bdb01315a5a69079c0433fc497ed1313719d5a10e05
  • SSDEEP 49152:DO3gbU9QcwndN4/XOz66vnP7g5jA3wvXX1nbDPfMu+UFr0JdyYtPMFoXT/x7p8:DC0Uq/np6a73wvXlUvUF4hGFo
  • TLSH
    T107C5BF12FBC281B1E59301745567B73F8D7DBA34672889C7ABC01D298C316D16A3A3AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan
  • Custom signature

    Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • Custom signature

    UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2