2026-06-02_459e5d297d70d0cb12ac8e0ef00c4a06_elex_stealc_stop_tofsee_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-02_459e5d297d70d0cb12ac8e0ef00c4a06_elex_stealc_stop_tofsee_virut
Size 298KB
Sample260602-tbe2pshw41
SHA256 0ffc7a426aac2fca1a36d334d557dc2058533478c17dce7766cbbe59be22aa82
MD5 459e5d297d70d0cb12ac8e0ef00c4a06
SHA1 6f65eb21b11b43a709c2224e33e3e7caa9920a77
SHA512 e20849197ce75f0e94c7380d67a9b61ffc8598b088fc83e77fe9584cd01dcd68a685fcd0e15a15a6d7233f31452876328d881d3fb5c010025d0bd1ea8e52d9f8
SSDEEP 6144:tQ4yjeq/dv7UKiQtbUjRL5H7+Cc+FE2htGr1KSM0/vgv:t8eBKhbUjR9H7+QE2nIM0
TLSH
T17B54AD203AC5C073D2A7347148D6DBB5FA6BB9304B2586CB7B904B6D6F316E15A3930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-02_459e5d297d70d0cb12ac8e0ef00c4a06_elex_stealc_stop_tofsee_virut

File Explorer

2026-06-02_459e5d297d70d0cb12ac8e0ef00c4a06_elex_stealc_stop_tofsee_virut

.exe 298KB

2026-06-02_459e5d297d70d0cb12ac8e0ef00c4a06_elex_stealc_stop_tofsee_virut

IMPHASH a0e183e4f9330dfc4ad61b335cd6fc69
SHA256 0ffc7a426aac2fca1a36d334d557dc2058533478c17dce7766cbbe59be22aa82
MD5 459e5d297d70d0cb12ac8e0ef00c4a06
SHA1 6f65eb21b11b43a709c2224e33e3e7caa9920a77
SHA512 e20849197ce75f0e94c7380d67a9b61ffc8598b088fc83e77fe9584cd01dcd68a685fcd0e15a15a6d7233f31452876328d881d3fb5c010025d0bd1ea8e52d9f8
SSDEEP 6144:tQ4yjeq/dv7UKiQtbUjRL5H7+Cc+FE2htGr1KSM0/vgv:t8eBKhbUjR9H7+QE2nIM0
TLSH
T17B54AD203AC5C073D2A7347148D6DBB5FA6BB9304B2586CB7B904B6D6F316E15A3930B
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

5b:c9:fe:72:a5:34:9e:1c:45:9f:5b:db:d3:a9:34:f3:f6:82:cf:81

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Controller Platform Development III,O=Fuji Xerox Co.\, Ltd.,L=6-1 Minatomirai\, Nishi-ku\, Yokohama-shi,ST=Kanagawa,C=JP

Chains

Sep 29, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

Serial Number

45:59:91:64:5e:49:fa:0b:77:0a:67:89:0b:78:58:4d

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 15, 2013 - Oct 27, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

337867

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

fxezui

?OpenMakeDiskDlg@CFXEzUI@@QAEHXZ ?SetLibClasses@CFXEzUI@@QAEXPAVCFXEzInst@@PAVCFXEzIni@@PAVCFXEzModel@@@Z ?SetVersionInfo@CFXEzUI@@QAEXPB_W0@Z ??0CFXEzUI@@QAE@XZ ?CreateMakeDiskDlg@CFXEzUI@@QAEPAVCWnd@@XZ ??1CFXEzUI@@UAE@XZ

fxezdll

?FXEz_GetResString@@YAPA_WQAUHINSTANCE__@@GI@Z ?SetDriverPath@CFXEzInst@@QAEHHPAH@Z ?SetSupportModelList@CFXEzInst@@QAEXHPAVCStringList@@@Z ?GetSupportModelList@CFXEzModel@@QAEHHPAPAVCStringList@@@Z ?GetPrinterList@CFXEzInst@@QAEHPAPAVCStringList@@0H@Z ?InitSpooler@CFXEzInst@@QAEHXZ ?FXEz_IsUserAdministrator@@YAHXZ ?FXEz_GetVersionInfo@@YAHPB_WPA_W11PAUHINSTANCE__@@G@Z ?GetModelNameList@CFXEzInst@@QAEPAVCStringList@@XZ ?FXEz_PathCat@@YAXPB_W0PA_W@Z ?FXEz_GetProgramDir@@YAHPA_W@Z ?FXEz_SetAppName@@YAXPB_W@Z ?SetSUTINIDataIntercace@CFXEzInst@@QAEXPAUIFXEzINIData@@@Z ?FXEz_GetOS@@YAHXZ ?SetUserLangID@CFXEzInst@@QAEXG@Z ?GetLangEnv@CFXEzInst@@QAEGXZ ?GetSUTINIData@CFXEzModel@@UAEPAUIFXEzINIData@@XZ ?GetModelNoByInfModel@CFXEzModel@@QAEHPB_WPAH@Z ??1CFXEzModel@@QAE@XZ ??0CFXEzInst@@QAE@XZ ??0CFXEzIni@@QAE@XZ ??0CFXEzModel@@QAE@XZ ??1CFXEzInst@@QAE@XZ ??1CFXEzIni@@QAE@XZ ?FXEz_SetHelpFilePath@@YAXPB_W@Z

kernel32

GetStartupInfoW RtlUnwind HeapFree HeapAlloc Sleep ExitProcess HeapReAlloc RaiseException HeapSize SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent VirtualAlloc InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SizeofResource LockResource LoadResource FindResourceW WideCharToMultiByte lstrcpyW lstrlenA MultiByteToWideChar GetProcAddress GetModuleHandleW FreeLibrary GlobalAlloc lstrcmpW GlobalLock InterlockedExchange LoadLibraryExW GetLocaleInfoW lstrcmpA GetModuleFileNameW EnumResourceLanguagesW ConvertDefaultLocale GetCurrentThreadId GetCurrentThread GlobalDeleteAtom CloseHandle GlobalAddAtomW SetLastError GetLastError GetCurrentProcessId lstrlenW LocalFree FormatMessageW SetErrorMode GetCurrentProcess FlushFileBuffers SetFilePointer WriteFile GlobalFindAtomW LoadLibraryW LoadLibraryA GetVersionExA GlobalUnlock InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GlobalFlags GetModuleHandleA InterlockedDecrement WritePrivateProfileStringW GlobalFree

user32

UnregisterClassW DestroyMenu GetSysColorBrush ShowWindow RegisterWindowMessageW LoadIconW WinHelpW GetClassLongW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetSystemMetrics LoadCursorW GetCapture GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect GetWindowTextW SetWindowTextW GetSysColor SetForegroundWindow FindWindowW PostQuitMessage PostMessageW ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW UnhookWindowsHookEx SetMenu CheckMenuItem EnableMenuItem GetMenuState ModifyMenuW SendMessageW GetParent GetFocus LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps ValidateRect GetCursorPos PeekMessageW GetKeyState IsWindowVisible GetActiveWindow DispatchMessageW TranslateMessage GetMessageW CallNextHookEx GetMenuItemID GetMenuItemCount GetSubMenu GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW SetCursor SetWindowsHookExW CopyRect

gdi32

GetClipBox DeleteObject SetMapMode PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx DeleteDC GetStockObject SetTextColor SetBkColor RestoreDC SaveDC GetDeviceCaps CreateBitmap

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegEnumKeyW RegOpenKeyW RegQueryValueW RegCreateKeyExW RegSetValueExW

shlwapi

PathFindFileNameW PathFindExtensionW

oleaut32

VariantClear VariantChangeType VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-02_459e5d297d70d0cb12ac8e0ef00c4a06_elex_stealc_stop_tofsee_virut

PE Signature issue

fxezui

fxezdll

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

oleaut32

generic