Extracted

• • Target
    2026-10-02_0c44fe4b28839e6dc2f76f42af48e57f_amadey_coinminer_elex_glassworm_hijackloader_luca-stealer_mespinoza_njrat_remcos_smoke-loader
  • Size 3.1MB
  • SHA256 f70a70998aea5bdd88688d35621244d8dbca8ffa023736154ff2510d057ee0d2
  • MD5 0c44fe4b28839e6dc2f76f42af48e57f
  • SHA1 6897967cfda4bf434a6d83461e529e1034ca934d
  • SHA512 8ad3f25bfd928c72dd5a3175ee9fb45829840deffd0366dbfc69846ac52da0ddac165f4236ee6695a4c1a1b4976533d875490bdc7ce05b9b8a9d0e4d5f73342b
  • SSDEEP 49152:sII460TK5gE0PojzgHfuV9xrDMhzMQ5P7ti5sKvDsBrZ0g2nxaH:1I43TK5gEBj4oxsltiZv4L0zaH
  • TLSH
    T182E5C002FB4284B2E883093151B7477B8975AD306738D5C3D7A239395DB11D2BA3E7AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2