oski | 2025-12-18_716aa8bb355c8c7653e786d0dcc23f60_elex_mafia_stealc_tofsee

General

Target
2025-12-18_716aa8bb355c8c7653e786d0dcc23f60_elex_mafia_stealc_tofsee
Size 206KB
Sample251218-frnrwsbw3f
SHA256 7951a90880f3c892255057cd9368da556e4605c2da8debcbcaa9d5729b4c789a
MD5 716aa8bb355c8c7653e786d0dcc23f60
SHA1 5e88d60ab5241761bae8a1a2d8445b72d09299a3
SHA512 7cb2b6165e6b5e34e2e78ff9932052e8fdd8ded4a4439b3f621d30e07f28e4780a03efc0334a8daf3d1db6749e6e955f231c02e7a5676e1fa7e559b56ce008c0
SSDEEP 3072:X1Euh1HQMprZc9cHSBKzWB1c+eZST2UbXIrIfImBYdvA:F9NNSBKzQ13tTxfQ3d
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

oski

Malware Config

Signatures

Oski family
oski

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-12-18_716aa8bb355c8c7653e786d0dcc23f60_elex_mafia_stealc_tofsee

File Explorer

2025-12-18_716aa8bb355c8c7653e786d0dcc23f60_elex_mafia_stealc_tofsee

.exe 206KB

2025-12-18_716aa8bb355c8c7653e786d0dcc23f60_elex_mafia_stealc_tofsee

IMPHASH 63452777488d6190b11d3afce5f06b0c
SHA256 7951a90880f3c892255057cd9368da556e4605c2da8debcbcaa9d5729b4c789a
MD5 716aa8bb355c8c7653e786d0dcc23f60
SHA1 5e88d60ab5241761bae8a1a2d8445b72d09299a3
SHA512 7cb2b6165e6b5e34e2e78ff9932052e8fdd8ded4a4439b3f621d30e07f28e4780a03efc0334a8daf3d1db6749e6e955f231c02e7a5676e1fa7e559b56ce008c0
SSDEEP 3072:X1Euh1HQMprZc9cHSBKzWB1c+eZST2UbXIrIfImBYdvA:F9NNSBKzQ13tTxfQ3d
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

96907

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapAlloc GetProcessHeap CreateFileA GetFileSize WriteFile ReadFile MultiByteToWideChar CloseHandle GetFullPathNameW FindFirstFileExW FindClose FindNextFileW LocalAlloc GetVersionExA LocalFree Sleep GlobalMemoryStatus GetFileAttributesA GetProcAddress LoadLibraryA SetFilePointer MapViewOfFile UnmapViewOfFile SystemTimeToFileTime GetTickCount FileTimeToSystemTime GetLocalTime CreateFileMappingA GetFileInformationByHandle WriteConsoleW SetEndOfFile FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle FileTimeToLocalFileTime GetLastError FindFirstFileExA FindNextFileA EncodePointer DecodePointer HeapFree WideCharToMultiByte GetSystemTimeAsFileTime GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId HeapSize ExitProcess HeapCreate GetStdHandle GetModuleFileNameW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind SetHandleCount GetFileType DeleteCriticalSection SetEnvironmentVariableW SetEnvironmentVariableA GetTimeZoneInformation LCMapStringW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetStringTypeW HeapReAlloc LoadLibraryW CompareStringW CreateFileW

user32

GetDesktopWindow

netapi32

NetWkstaGetInfo NetApiBufferFree DsRoleGetPrimaryDomainInformation

Sharing