Extracted

• • Target
    2026-09-10_3073cf6cd7e1c34a43e3c9f0c0a2344a_amadey_coinminer_elex_glassworm_smoke-loader
  • Size 6.5MB
  • SHA256 f1e95aadc863c6f40b7eca776f3ba56faa2b00625abb72579f91cd9f7e4d44a4
  • MD5 3073cf6cd7e1c34a43e3c9f0c0a2344a
  • SHA1 fb30aa5b997617c38bfa1146e347d9a9a33dfcc9
  • SHA512 b32974463bbf03c3c71cd71d5b7892eb67a7fce0f31320957d0787c742c1a36c0336e87f21942eac4e39d6ba1e01723ab46f7d1148e4541e8336334a1467607e
  • SSDEEP 196608:CnPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMr:CyUUUNHg1wGd6QxbEwJ
  • TLSH
    T153662332E2406037D5E20AF1AC6496707E79BA286B40D86BD780AF1D7475193B7FB31B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverymofksyssalitypersistencetrojanupxworm

  • Detects Mofksys worm

  • Family: Mofksys

    Mofksys is a worm written in VisualBasic.

    wormmofksys

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    defense_evasion

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2