Extracted

Extracted

• • Target
    2026-11-09_ce7bc1773703ea932382fc103675a768_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glassworm_pos_smoke-loader_stop
  • Size 4.9MB
  • SHA256 c4632bef3a0ffa6d0ffba0171d3d2bb9aa2c6f12950820cda901e41588ae2a5f
  • MD5 ce7bc1773703ea932382fc103675a768
  • SHA1 4d0098953a1d31958311487bc32cba1296cacea4
  • SHA512 1765d47fd47f1eb1689fa871ce071727ca5672ca1731aba0adf9092d0377748f040d4b9320af9e1d8c8d4a7e6e0b3d6141a3e039ab1a37cf7d633d07c0643c18
  • SSDEEP 98304:Qnsmtk2afFzsZCqVTSUho63Y50YiVQyjAaGDJ4hqh:uLyFJqVOboY0YiVvAaGDWEh
  • TLSH
    T13B36F4EF9661CFEACDEE0CF27C7A416A54156E900F1360CF928239195A7D9C36B32139
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionsalityxredpersistencetrojanupxmacro

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan
  • Custom signature

    Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • Custom signature

    UPX dump on OEP (original entry point)

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

    defense_evasion

  • Executes dropped EXE

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2