Extracted

• • Target
    2026-09-30_5e2282b8104ce1568c9d614f359b2ab7_amadey_elex_emotet_smoke-loader_stop_swisyn
  • Size 2.0MB
  • SHA256 9b9cfa99ba77659631187f71142c482386fe4a04885720769a12d930df532107
  • MD5 5e2282b8104ce1568c9d614f359b2ab7
  • SHA1 958035912b9c668cd4fa033f93dccd5d873704d1
  • SHA512 290ca8f5624564b484ab3d10cfdafedc204d7e82d45aef2d6584b331866bfdf1bfeffb71148558a184354a4e9eebd7ab35529668b024d6d0e90d9493b845bb21
  • SSDEEP 12288:zFUNDa4KlMYaqLCn1lOW3A9EF9Q0l5EOZApAXCDO:zFOafNLI3On9EY0lFWTO
  • TLSH
    T1EFA50591FA9B8066D1798F73C8A59ED9E3D769D02EE0578E22803B1497F0683673CF11
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypersistencetrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2