Extracted

• • Target
    2026-09-06_5377b5cb21bce780eae9d539ea72080e_amadey_elex_hijackloader_magniber_remcos
  • Size 426KB
  • SHA256 929b7b9066b09086a129152138ceb8936e59dbbd2fcc7c4a3c6c6eff501571e4
  • MD5 5377b5cb21bce780eae9d539ea72080e
  • SHA1 9202442d09064bd804fe5edd1d0f0be1431fef72
  • SHA512 37b011b99ee1bec497c5b96338127f7ca04589b37785ff4e997909d37113d7ba3083d1e9a3bfdfd9e309f4a4417a1d4e93ce1d5f6541b94b5596b8ff262257bb
  • SSDEEP 12288:iGjBl25n8/jzKV3u1nxrT9tmEdcoG6+BdA:FT2BcjzLxrT9EEdc/A
  • TLSH
    T152949D207E82D131E592113297BEEAB1497DA631171B21CB37D80A3A5FB07D29B3536F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2