Extracted

• • Target
    2026-11-06_f61fd2dcd70de946d864c375f4679994_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
  • Size 6.3MB
  • SHA256 02fc04d3f86ac40e68c2679f1d926ffabc09005d42b9423187adc859acec4b74
  • MD5 f61fd2dcd70de946d864c375f4679994
  • SHA1 22a26905e48c4396dbdba1fa9f35299db2b62353
  • SHA512 84829c2175e4f59b1d6fec63e2df9b43ce768d7ceaa402aefe5520d7a043a1abb684fc1850d7b8fd7e6a55a07bc765b7d1b720732e0631a8672243669894cf8c
  • SSDEEP 98304:ewQeMsLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kjRm4OWL22ImljBV:selZF6bUpMBF1p/kjRm4OWi2b
  • TLSH
    T150663329AC864272C277183388B2D67129393AF60F2954674BD52B3F0B725B17E3F479
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitypyinstallertrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Loads dropped DLL

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2
• • Target
    downloader_req.pyc
  • Size 574B
  • SHA256 86d9b7e58024e89db787dda9dcb38da9925946f7d05e373c52e3a109ce335817
  • MD5 02aef2d0a6566f4e328c04dce11f8ab5
  • SHA1 43d23cd6f12dc3740e6dac3363238d260390001d
  • SHA512 c549444d9978a4a09268e15bddfd13b9dfe89cb5c42e16e1a80d3e1ec7ecbe25977bb0325fc27aa45d1c0c36d06a120536c59838d86f6f1821971623e51c7f48
  • TLSH
    T1F0F0EB6B423B6057E0C2C734503016A0B2D29BA6EB289987821940CE0CC80F0BBD1387
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral3behavioral4