Extracted

• • Target
    2026-10-28_96abb9dccda792a173b5a33b69d9417c_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
  • Size 6.3MB
  • SHA256 1952d3640652bf7740937640dfad7a930595608ecda0eb0276bb2f7e20b439ee
  • MD5 96abb9dccda792a173b5a33b69d9417c
  • SHA1 593b449af07e90daaa73f428747183290a42c4b3
  • SHA512 b59fcca417842a25b9dda4cb836e4cc2f6dba691299a6eb2506c7b8dbebd871e0f4b9b9014b1b6f94161b79411724341526e08a0309d239ca6bd033c1637ad23
  • SSDEEP 98304:w2QeMBPWLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22ImljBV:EeUWZF6bUpMBF1p/kjRm4OWi2b
  • TLSH
    T13166332AAC8641B2C237183348B2D6712A793AF60F2854674BD51B3F1B725B17E3F479
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypyinstallertrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2