Extracted

• • Target
    2026-09-25_a8e846d598e7af27ea7d583cdd9d6ca9_amadey_coinminer_elex_maze_smoke-loader_stealc
  • Size 1.2MB
  • SHA256 56c8ec0eeae6a0167656d6869be607e778c2673fc06362be29f4b06fda54927e
  • MD5 a8e846d598e7af27ea7d583cdd9d6ca9
  • SHA1 4e1b13a93e7590c6bc3a3bf8fff0fc9c14266163
  • SHA512 776abde7946683681022d395828e9593d4575b04a7397deda2bfcc9a0138b94aee64a6fba45b78e3728aa68bb19a7fc29e5e41cc29a5ac05e96c6770c6a1faf8
  • SSDEEP 24576:5II2mRVMuLi/mDnICLJ4gxqBe97/ATDNoo3cK0Ef2gsOdCYL:cmRV247qBe97/ATDNo2+Ef2gsOdCYL
  • TLSH
    T1E5456C04FB43D2B9CE6301B02667FB1A507879859B296ED3D7D83F0A0531AC2BA3B55D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitystealcstealertrojanupx

  • Detects Stealc stealer Version 3

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2