General

  • Target

    2025-07-04_0e3c1e2c40ad65759fb0dad9a72f0870_elex_stop

  • Size

    25.4MB

  • Sample

    250704-yl22faxybz

  • MD5

    0e3c1e2c40ad65759fb0dad9a72f0870

  • SHA1

    2964d7699a3594dc146adbd20831b181bf32cec7

  • SHA256

    4cd1eae3177fc4cebd8d786a82aa391fd960ce7822697dd20ed7be44b0e60cdb

  • SHA512

    eaee12ecdc252ce594566c900d0a646052406c11925b8c4a8c1ff04a9cd10d9233162da120e0503b67a47fb79f51e6235dcd3bba467ee1562fbd6dfa9df90f73

  • SSDEEP

    6144:LkPLAmDjlvsnLRWlK46r888arrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrA:LYLf9ULRWlZd

Malware Config

Targets

    • Target

      2025-07-04_0e3c1e2c40ad65759fb0dad9a72f0870_elex_stop

    • Size

      25.4MB

    • MD5

      0e3c1e2c40ad65759fb0dad9a72f0870

    • SHA1

      2964d7699a3594dc146adbd20831b181bf32cec7

    • SHA256

      4cd1eae3177fc4cebd8d786a82aa391fd960ce7822697dd20ed7be44b0e60cdb

    • SHA512

      eaee12ecdc252ce594566c900d0a646052406c11925b8c4a8c1ff04a9cd10d9233162da120e0503b67a47fb79f51e6235dcd3bba467ee1562fbd6dfa9df90f73

    • SSDEEP

      6144:LkPLAmDjlvsnLRWlK46r888arrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrA:LYLf9ULRWlZd

    • Adds policy Run key to start application

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks