Extracted

• • Target
    2026-10-22_089e62b1fd5ac8ded5474ea42ad9b603_amadey_elex_ramnit_redline-stealer_rhadamanthys_smoke-loader_stop
  • Size 194KB
  • SHA256 0a012ea0ad801d36c230661d83df6f77e2cc154ba6cec2740d10be32f3e0697b
  • MD5 089e62b1fd5ac8ded5474ea42ad9b603
  • SHA1 6caf4895eb02f30d326b0f6789b4b03cc1a8c7e3
  • SHA512 551d637e4829835f7d99d4852dc5f359b5698303c4fc23cc9950fd8742f17ac7b83724a6d098db36d28be8e608e778395b12df94920e38a0ddf41d155266429d
  • SSDEEP 3072:cCLVpImRqLOUph/uZ2HojxMYsoDwVjcALjXtXa/nwX5c6LsXS5QRNd6:FLVpOjGZ20xMVdVjcALrtXI65HISoN
  • TLSH
    T14414F118B989C472D41264B81496C7600B2EED2227D555CF3BB6BA9F9F712C3C23731D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2