Extracted

• • Target
    2026-09-24_1a84401059d4b64161a327e160d7c803_amadey_darkgate_elex_icedid_remcos_smoke-loader_stop
  • Size 2.0MB
  • SHA256 a78063b665a36c82ad83be23e9743df052980c9e068cd5ebeef9d8263a560e5d
  • MD5 1a84401059d4b64161a327e160d7c803
  • SHA1 2c93a57f9ff7ae6e78e47734530325205e650a79
  • SHA512 490b7ad7ec4ec4342b3804786238dc1cf149bb03c0ea62f0eeee3164d8b04ce3543dcc4a1162b40f2c052aea6e69a69597c4a411881b64707e32338664ea4a23
  • SSDEEP 49152:+4yfD+HoecwnpkguSFlg+nT+QThsqEOriDjCizjJ:+4yfNeoSF++JTDyjCih
  • TLSH
    T170958E10F790D03AF5A300FA8ABE457DAA25BA30174515C7B2CC1DA95F329E27D36B27
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2