Extracted

• • Target
    2026-11-13_1547773e9a4b07ec2fe0b7b87698c36a_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
  • Size 520KB
  • SHA256 4d188097d98192e8db2da8f59aaaeb9101359ca5e32ac4235666858c040fe41a
  • MD5 1547773e9a4b07ec2fe0b7b87698c36a
  • SHA1 ec9192e2fb97dcade139dba270ef4ac0b8350a45
  • SHA512 5667591274100d81634dd4f38e6a449d08da2d455d3f46c0b05d6a832eaab9fbd1d0576976af253717fcd9b26335ee1f57275014639908f7d08324bb8e9fec43
  • SSDEEP 12288:/Zc0IursYCYQeSnyZJiqlEbXSb9Nt7qOFHoqUQgplHk4dU:vMYenGJiKEbXWt+OtBf4S
  • TLSH
    T16AB49F3266949032D6B21473F529C5307E3DA1196F2048EB9790DE2E3A7C586BBF734B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitytrojanupx

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan
  • Custom signature

    Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • Custom signature

    UPX dump on OEP (original entry point)

  • Loads dropped DLL

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2