03d1b4cb611140c6361d24d78e25c41f4380fb3a8e812d004e3ddb5557da915c | Triage™

Login
Reports

Overview

overview

7

Static

static

3

2026-05-04...op.exe

windows10-2004-x64

7

2026-05-04...op.exe

windows11-21h2-x64

7

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-04_2587c889b9750fd4e07a7f06460134b5_elex_redline-stealer_stealc_stop
Size 420KB
Sample260504-d2vxvafv3m
SHA256 03d1b4cb611140c6361d24d78e25c41f4380fb3a8e812d004e3ddb5557da915c
MD5 2587c889b9750fd4e07a7f06460134b5
SHA1 19597759eec0e66e468923a1f3cc97c80158f28c
SHA512 3e73bfc280aa03d0b8df3437f56984879e6ab8fa603b47bb245dfb37d88da074763ead0f95a881979a026726a599cd1312d1fec2c4cab7063e218a54e174105e
SSDEEP 6144:jOOuzktg13PFYd8O616pd0Ps6oILaW+nWPmHDoJqCY7Wl13zLi7:jOtzkeP+81+d0Ps6naW/mMJplLi
TLSH
T112947B19D997E0E6D722A5F0229ED372C8F0303061E8B582F981666DDD38DFBA731647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence phishing

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2026-05-04_2587c889b9750fd4e07a7f06460134b5_elex_redline-stealer_stealc_stop.exe

Resource

win10v2004-20260130-en

windows10-2004-x64

7 signatures

150 seconds

discovery persistence phishing

Behavioral task

behavioral2

Sample

2026-05-04_2587c889b9750fd4e07a7f06460134b5_elex_redline-stealer_stealc_stop.exe

Resource

win11-20260130-en

windows11-21h2-x64

6 signatures

150 seconds

discovery persistence phishing

Malware Config

Targets

- Target
  2026-05-04_2587c889b9750fd4e07a7f06460134b5_elex_redline-stealer_stealc_stop
- Size 420KB
- SHA256 03d1b4cb611140c6361d24d78e25c41f4380fb3a8e812d004e3ddb5557da915c
- MD5 2587c889b9750fd4e07a7f06460134b5
- SHA1 19597759eec0e66e468923a1f3cc97c80158f28c
- SHA512 3e73bfc280aa03d0b8df3437f56984879e6ab8fa603b47bb245dfb37d88da074763ead0f95a881979a026726a599cd1312d1fec2c4cab7063e218a54e174105e
- SSDEEP 6144:jOOuzktg13PFYd8O616pd0Ps6oILaW+nWPmHDoJqCY7Wl13zLi7:jOtzkeP+81+d0Ps6naW/mMJplLi
- TLSH
  T112947B19D997E0E6D722A5F0229ED372C8F0303061E8B582F981666DDD38DFBA731647
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence phishing
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistencephishing

behavioral2

discoverypersistencephishing

© 2018-2026

Terms | Privacy