Extracted

• • Target
    2026-09-09_1152d16ed048d608ee27e65d30bffc77_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 119KB
  • SHA256 659d1bf590df98cf0bc791af529af55ec34bb036dcb76eb20eda594bacf52d37
  • MD5 1152d16ed048d608ee27e65d30bffc77
  • SHA1 1219ebc7838f45e77d8e5b41bb885c2821492dc6
  • SHA512 34e1ba15ad3eb406499fb132bef2b676dcbcf642bd6350fb0aa851202d4fb64230401cd86d497dcd6532bf928c697ab22ef38989dd7ebadab6fbbea122b07d8f
  • SSDEEP 3072:Kw6DSbca7C7IRJX4vANlymWdcFwfnZhrx:Kw6DUc+X4oNlytdk8ht
  • TLSH
    T1C6C3D0123110C03BD45210B55819D2B29E7FBA3116F6D887BFD907BE4F72399AA3E257
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2