Extracted

• • Target
    2026-09-09_74961bfabfa69e8d4f8076c6ec2cb0e5_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 127KB
  • SHA256 ca7346edc474e4c2004b85bead19d291a8bc9fcbcbcbb520a13e1141d72c748c
  • MD5 74961bfabfa69e8d4f8076c6ec2cb0e5
  • SHA1 d67e4931ac8f20ce231f0ed69a6507e38af6fe95
  • SHA512 7a2943258bf5bba04e2a9b6f7a6317a494b9ffc06df308bc3dd09ee4438849cb37dbbe2628c65aed04c4892a95999de5bc9f1d9c9f97924d6cc5ca82fe720153
  • SSDEEP 3072:b7DSbca7C7IRJHuoOX7uiUP5RLxzztlZ3v:b7DUc+tOXCFPzLl1
  • TLSH
    T15CD3E0553940C07AC01650344979C2F26F6EBA3212B6C4877F9817BF9F237D9AA3A35B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2