Extracted

• • Target
    2026-09-24_c292e855d58d4bbfbe41204002f4aa27_amadey_elex_ramnit_rhadamanthys_smoke-loader_stealc_stop
  • Size 253KB
  • SHA256 8d4f2e23f2489e50ec0026465dab0055f000df0280ebe68ee44bb1081298b001
  • MD5 c292e855d58d4bbfbe41204002f4aa27
  • SHA1 8be1b11720d0bcd10ce869a10012b242435e4fa0
  • SHA512 c70f6dda88810da5888cd045fb50b6e208e4b1deca158f0d68018e72ac64dd64fc93ffd60a230015b3ed654d2447736bf70458f4edc507ddd83bd0ba0e0c83be
  • SSDEEP 6144:65wAJyQJ1MLgEfLopykMXN95hFT8uXzZ6:G7BJ1McEMpjCL73
  • TLSH
    T1164401517841B473ED30C57A848688A94ABDBD215B63E9477A403BFF3F712F1A8321E6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionsalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects Reflective DLL injection artifacts

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2