Extracted

• • Target
    2026-09-29_cadef534a07c383ecd730d10a0c21c6f_amadey_coinminer_elex_maze_smoke-loader_stealc
  • Size 1.2MB
  • SHA256 59f8ca328a4690a812a84fa91d0df48090e9d42051fc983b689a9361e3497490
  • MD5 cadef534a07c383ecd730d10a0c21c6f
  • SHA1 c7b141232e1595cbe656227970e76d629dba0cf9
  • SHA512 0a120ca7782be2197f4f8cc2d6d6f65c08475bd7b5fd0067995a237b13e00ca775e087c564742e706c184341f0ea57b2b7153503c4ab63624783e210f042a390
  • SSDEEP 24576:uII2mRVMuLi/mDnICLJ4gxqBeO7/ATDNoo3cK0Ef2gsOA8NI:xmRV247qBeO7/ATDNo2+Ef2gsO7I
  • TLSH
    T161456B04FB43D2BDCE6201B02667FB1A50B879859B296ED3D7D43F0A0531AC2BA3B55D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoverysalitystealcstealertrojanupx

  • Detects Stealc stealer Version 3

  • Family: Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality

  • UPX dump on OEP (original entry point)

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2