Extracted

• • Target
    2026-09-04_9e126d9b94559d4ece5f8c3552cf1a37_elex_emotet_icedid_stop
  • Size 3.1MB
  • SHA256 46f5a23621fad05d97b494b8c02d8bbeae71752a5455bf5068c67f1b74878a49
  • MD5 9e126d9b94559d4ece5f8c3552cf1a37
  • SHA1 158e3ff87546361b59ee3d68b38345b1b1ab744f
  • SHA512 324aa45ae0dbece755ac849a4a163136902ffbe664b0b1d2be0e55aed7609a82892911ccef05e990940c2fd2eb6e5c653638cdcfd4706ff96f570ea96c6707a1
  • SSDEEP 24576:fYq2Ie+RB+ICZxvQ6Kn4Q4OrgqY+VE4Sm5PLm2Rr:Re+RBfIvQ6XQ4C1R
  • TLSH
    T1BCE59E207780D035E5E301B68B7E867EA679BE22071459CBA3D43D5E6F705E26E3234B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2