Extracted

• • Target
    2026-09-16_1df1c7bbb927f8f451656ebc45f961fa_coinminer_elex_remcos_stealc_stop
  • Size 1.5MB
  • SHA256 aaa2d485736171ee8cca7fb457cac0d126b06310b167326f847d7def6f0f7011
  • MD5 1df1c7bbb927f8f451656ebc45f961fa
  • SHA1 78c14405b459cd6dd13b979a95762ba528f19ff1
  • SHA512 65c26ff0a5492d0855f47f2b7fed41ebc8e9fe5cacccc071889d5f354f516ba1373796240078390f1dd76691ec0e10c98bfcc09f6a81aa52174bf930bb2fbd89
  • SSDEEP 24576:9pFWBE1mRiCVIRSlFzPgHm57QtMOtsCqPswNh5gkkvSJYp91TWePO:6ymR9NTuXw2MK91TVP
  • TLSH
    T13775AE907BC0C1B1E9921175447A973A8E7ABD52273856C7E3D43E5A8E313D2AE3234F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitystealcstealertrojanupx

  • Detects Stealc stealer Version 3

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2