2026-06-27_f9f27322f536d467a901d7d65fc4de26_elex_mafia_stealc_tofsee

General

Target
2026-06-27_f9f27322f536d467a901d7d65fc4de26_elex_mafia_stealc_tofsee
Size 411KB
Sample260629-bgs7eah15t
SHA256 631ab972194026cc95ac30e971947869aa470d651b159ed74f6e86c7c1838c71
MD5 f9f27322f536d467a901d7d65fc4de26
SHA1 61ace19131c0e33129e9df19090440abb608e8d5
SHA512 00600bef51e9b0975aab21d9b55c8dcc8696729787f5939842e5db991fcb092dd4a3537e1f91cdadb9240263cef311ddef5b1b8e6f70d3f66812a69127b87e4b
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFddEl6P6nI7nAJpF2XfbJaD6UqFZqHI:gZLolhNVyEQ6l6YI7nIpiJ6APqHI
TLSH
T14194DF24B680C036D19301314BF6DB72693A7DB15B6264DBB3943B3E1EB43D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_f9f27322f536d467a901d7d65fc4de26_elex_mafia_stealc_tofsee

File Explorer

2026-06-27_f9f27322f536d467a901d7d65fc4de26_elex_mafia_stealc_tofsee

.exe 411KB

2026-06-27_f9f27322f536d467a901d7d65fc4de26_elex_mafia_stealc_tofsee

IMPHASH 6dca3e9fb3928bbdb54dbce669943ec8
SHA256 631ab972194026cc95ac30e971947869aa470d651b159ed74f6e86c7c1838c71
MD5 f9f27322f536d467a901d7d65fc4de26
SHA1 61ace19131c0e33129e9df19090440abb608e8d5
SHA512 00600bef51e9b0975aab21d9b55c8dcc8696729787f5939842e5db991fcb092dd4a3537e1f91cdadb9240263cef311ddef5b1b8e6f70d3f66812a69127b87e4b
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFddEl6P6nI7nAJpF2XfbJaD6UqFZqHI:gZLolhNVyEQ6l6YI7nIpiJ6APqHI
TLSH
T14194DF24B680C036D19301314BF6DB72693A7DB15B6264DBB3943B3E1EB43D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

70614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetComputerNameW GetLocalTime SystemTimeToFileTime FileTimeToSystemTime SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar GetProcAddress LoadLibraryW GetCurrentProcess LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetLastError CloseHandle WideCharToMultiByte MoveFileW DeleteFileW CreateDirectoryW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW lstrlenW CreateFileW GetFileSize ReadFile WriteFile Sleep GetComputerNameA GetModuleFileNameW CreateProcessW GetSystemTime FileTimeToLocalFileTime RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalAlloc SetEndOfFile SetStdHandle WriteConsoleW FreeLibrary LoadLibraryA InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentThreadId RtlUnwind LCMapStringW GetCPInfo SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage SetFilePointer FlushFileBuffers GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW

ole32

CoCreateInstance CoInitialize

shlwapi

PathIsRootW PathFileExistsW PathAppendW PathAddExtensionW PathRemoveExtensionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_f9f27322f536d467a901d7d65fc4de26_elex_mafia_stealc_tofsee

kernel32

ole32

shlwapi

generic