Extracted

• • Target
    2026-09-30_e539fba169930e321f5c531465ff55c7_elex_stealc_stop
  • Size 1.2MB
  • SHA256 60e25a5076f8ce3eafe47c3176628b1e9aeca57c40172602548b69a3acf9f9be
  • MD5 e539fba169930e321f5c531465ff55c7
  • SHA1 747145ced00b8f26855ca2264a5ff15c35a06c72
  • SHA512 039e9fec63d039c433bda7ea0b277b80ef854529a24dea25f7fd591c7e37ddc1e65f5f67e84f742b51eb10c56f739e68f6401939ea7ae364f903af800de9df7d
  • SSDEEP 24576:1xNlFSIthzcjwhhfvyERsHo0VxvkTbFrxGQWWDWw0:17KIzyYh5Oo0wTbF1GZ9w0
  • TLSH
    T164455B1376C1C03FE2A215728C6F9EB846A17C275A30455BB594FE3C2EF4592B923F1A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitystealcstealertrojanupx

  • Detects Stealc stealer Version 3

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2