fe51d5b82515684b873165fb20e12158171451cc31a6fc47ebd81d722c77c8e3

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_a2bc87ac90197f69a77140939822a5f8_elex_smoke-loader_stealc_stop_tofsee
Size 1.4MB
Sample260629-e2clyacz9x
SHA256 fe51d5b82515684b873165fb20e12158171451cc31a6fc47ebd81d722c77c8e3
MD5 a2bc87ac90197f69a77140939822a5f8
SHA1 b1cb4037274e740ea4fa0194b9a8ab07c65eb049
SHA512 7f9ebb483801bb0d26f26863f5f0f4746fbb85fda2ca23c2ef73d316e31fa3950946fd9fd5045522b6c7a57eca9647b7a6cafc31e29e112b3d1b4abc4746b1c8
SSDEEP 12288:jwKfOVRo9yRYHSSX0qUSDEHTqdvIkQWbTqWLsWrVOFz:jxWVeyRYySPhbUz
TLSH
T16B653D2173F9C118F2F77B70E97546F50AB7BD62EE34914F22443A2D2970BA09960B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  2026-06-27_a2bc87ac90197f69a77140939822a5f8_elex_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 fe51d5b82515684b873165fb20e12158171451cc31a6fc47ebd81d722c77c8e3
- MD5 a2bc87ac90197f69a77140939822a5f8
- SHA1 b1cb4037274e740ea4fa0194b9a8ab07c65eb049
- SHA512 7f9ebb483801bb0d26f26863f5f0f4746fbb85fda2ca23c2ef73d316e31fa3950946fd9fd5045522b6c7a57eca9647b7a6cafc31e29e112b3d1b4abc4746b1c8
- SSDEEP 12288:jwKfOVRo9yRYHSSX0qUSDEHTqdvIkQWbTqWLsWrVOFz:jxWVeyRYySPhbUz
- TLSH
  T16B653D2173F9C118F2F77B70E97546F50AB7BD62EE34914F22443A2D2970BA09960B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  .rsrc/1033/HTML/IDR_EULA_JSC.JS
- Size 534B
- SHA256 6b6fbea046f2b4b1115478b4146a71bfddbbdd1e2649fa710e906f68f48bb979
- MD5 bbc424e03b2f814e3141a698dfe2fe21
- SHA1 00becbc776af04bb77d255c388b1d699770baa7b
- SHA512 2c618c31ce46147d899a71f6557fef4ef95fcc53093385297c3016cf461d3198d3fc2a75a57f1f990d44bf47029753809e40ecd98a3a2bcdfc18b1e8f9b61975
- TLSH
  T1EBF0F66F34D614B1247FA435650BB35C347441103109CB81B1ACA1906DB0E23D13BBE8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  .rsrc/1033/HTML/IDR_OEMPG_AR.HTML
- Size 2KB
- SHA256 82a5684d33b2286997f2597a1bbf9e4ea66cf93f6906bb50678cbfaebe6fa161
- MD5 0231518dc983c06e44c61d385c6e5089
- SHA1 ddbcd1518a01632e2343100422cfe0429d1519cd
- SHA512 6f2d268bf37de8f6b54d1e461a6d127796cb467637f9b4344c85ab4c073608ed7648f18d945c38a8ae196b8cd403b5a2083a6afa0c097ef1845fabf6bd45144a
- TLSH
  T1C5411D623AB151694511C089E2D17E29DCA19823C707A860B0EF16A50FCDC83999B2BC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  .rsrc/1033/HTML/IDR_OEMPG_BG.HTML
- Size 2KB
- SHA256 eea2865b033314233f44f1e7d468c5daad646a8ed8d979b1bd962427acc81161
- MD5 fcb2d810a3c364177a85e93ace5d27f1
- SHA1 807580a43c4e4ce0850c76581deccaf140f56f49
- SHA512 2cbef69dfc48479c1c1f63625898b823d660aaf6641c7e318a12b553baa490ad3da4fcfa7494b957bcbf2c4f0724d201d7c0afce5f692c21aedd7e2f75943843
- TLSH
  T1F741651136F2298F4510E0AED9503E062DC1C57BEF538650B0AD1ABD3FE8C9646AB75D
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  .rsrc/1033/HTML/IDR_OEMPG_CA.HTML
- Size 1KB
- SHA256 f747e72651348c708ede01c32b02130412b5187126b30b3466b7cc6ae0d2d9f2
- MD5 05c31b3b188883722463156017d5aefa
- SHA1 b75ddd4dfefe2223486b7c73c8e12e99a2c5c5b3
- SHA512 a484069e08e54b1ee0c7e85e5cc0a3bd72acb644d7fc80bb1babbfb3223bda4036f6171ec12f49d7dc33bda50cdc1d25de0cdc43718cf5a4eb33f1ed6ded015e
- TLSH
  T19C41442375F1269E8900D0D0A3E2BE176DD0C423C7068450F49E66BA1FCDC879867BAC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  .rsrc/1033/HTML/IDR_OEMPG_CS.HTML
- Size 2KB
- SHA256 ce857a0c31a3df266291a652dd67f9fa5f9d6dc6c5d10fa1e23517bed7f71975
- MD5 57f06b28eb70612cc928a2e5c504f56e
- SHA1 288ef41341d996a83d48306a34df79a3ed6473df
- SHA512 5b6797b9c454610985d1589e2278366aa5228d90c75c015b4e9ce5dbd84e49c29ac5b21d35ce8bbd8e00709c85c4c8e99bcf784919a85d59ddf6d969f0a749a9
- TLSH
  T14D41531275F1664E4910C0D4B7A2BF155DD18223CB06A460F4EE16B60FE9C83A8A7BAC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  .rsrc/1033/HTML/IDR_OEMPG_DA.HTML
- Size 1KB
- SHA256 8de9c71b9c02ee41cc403d79984b9e64ca7db23d336742a446f30a07c40351fb
- MD5 febffff17460ce4c8b7a6fe97408c119
- SHA1 02a9d71366a75933828ac13198e48d0bd94c6f1e
- SHA512 708618e7fdf0da415c710e145f3bcd3703a80cd1bfb5eca660d9fb653922743733793d93664885928e3f372dff31eecbc25aad3e55bfa40e78600318114b79b8
- TLSH
  T11241661275F13A5E8950D0E076A2AF2A5ED08123CB4A5890F0DD25BA1FDCCC7557769C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  .rsrc/1033/HTML/IDR_OEMPG_DE.HTML
- Size 2KB
- SHA256 fed1ec15d9c98636de99e7df6ec13032d31358cec00d5b5bf796953e8b582ac6
- MD5 357bf390608cfbda42e2e4c0bf5da33a
- SHA1 7fb0a1947da61512ecc1d5a1991da357c62ed442
- SHA512 22af67827384ac15993c59c1e15d26bdb2f4cb64e7e6bd6a81d564330d4d9c5b5ab9e7bd01053f55187b52433f5d4544e367b9c752ca85cf800a1c07b027df62
- TLSH
  T175418422B9F2294E8914C1E073A1BE165EC18237C3455894F0AD52BA1FDDCC3992BBBC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  .rsrc/1033/HTML/IDR_OEMPG_EL.HTML
- Size 2KB
- SHA256 7a97813c3fe595cceaed15f3814fffabaf57e17078f93e437ac05ac5c1262e34
- MD5 22a2ec2344ae44cb2b75dbc34d2ffff3
- SHA1 8fbca04b803e16239de732fb6ab94b6e60d3e4c6
- SHA512 b7121bf0bdd3126b18a506c8c4beba3ec968ff8a4fb5e68480622b4e8e29ef48b5ae6031cc5cebdee26711f02109ce41f3302201301a4dc77f64395a70f7c80b
- TLSH
  T1D151209B70A12E5E8000D09642D4BA396FC18C26D705C9D8F16D9B757FECC83A927A5E
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  .rsrc/1033/HTML/IDR_OEMPG_EN.HTML
- Size 1KB
- SHA256 ba7ab577aee88de83005db0ea0a59fdb87af249f9f0967f28a6e67252a9247d2
- MD5 aa883df23b01475d16ca857e87a4b9ac
- SHA1 6747d0a36ba4463b55445df2b699af59d64d09b0
- SHA512 a1d9b6a9887998ce6115e85fd7735dd74f40616454ac219fd39e7109b2da673df3fc7f13beec5d9abdc205e9844e0e703f3f8b99c1dc53c8739666518e310f99
- TLSH
  T117413322B5F12B5A8950D0E0B695BE165DD08123C7464460F4DE26BA0FDDC83553BBAD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  .rsrc/1033/HTML/IDR_OEMPG_EN_GB.HTML
- Size 1KB
- SHA256 ec806188d29e4bc170b5aef3b9755fe60b245a8cca75e08b8d23777f6b15b7f8
- MD5 166c72a1c61b16d752d3c82aa5f12b89
- SHA1 f2145afbefd9a184a599d0fa8f1651fe9b96769a
- SHA512 40495759da650be14dcf2ba1d4317d07ea7f05c3f488bf811e7ca46f4805170cd15a491f84dbfa4ca971c8eca9ae28195d844fd5c05718f28589493bdbd289d3
- TLSH
  T183415322B5F127598950D0A0B395BF165DD08123C7464460F0EE26BA0FDDC83953BBAC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  .rsrc/1033/HTML/IDR_OEMPG_ES.HTML
- Size 1KB
- SHA256 cd72c67fa2a86ff74e468c00398ba9ced9d05bac8b6b545fe2fe95c4e5b26b19
- MD5 1bd12d2527cf896a739729b86c0bd5a2
- SHA1 d405e3c8e9937b60f1019fb71a227dbee2fe33b3
- SHA512 507d7fdc99e69ec10c7a82899b70ba72747e947c3c18b3f920a1382295b7110b1fb3b84f41dc5931699b534e6b5fac26bf6ca3d2a4bfcb1437ef444a24baa59a
- TLSH
  T13B410F12B5F22A8A4A55D094B3A2AF175DC08123C705D4A0F09E52B65FDDC83D867BEC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  .rsrc/1033/HTML/IDR_OEMPG_ES_419.HTML
- Size 1KB
- SHA256 c1ac3f339a94463f6c5d76d40b4cd8b01151c1888618f869d447b95f5675d1e7
- MD5 6f47e739465709eac314be5b899c9a71
- SHA1 12ef2ff7da54efec7d678d00e1615c4769ea229d
- SHA512 392f263787d36c20a2bf991f7a0355659e8ab8b4b9eef292f9ea7ec6e54a971983040ff1dc40f007b7b29f33af05ec88587bf9c5f9bd526e1b85e0a0e595dabd
- TLSH
  T19A41401375F22A4A8555C0E4A3A2AF175CD18023CB05C460F49E62BA1FCDC83D8677EC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  .rsrc/1033/HTML/IDR_OEMPG_ET.HTML
- Size 1KB
- SHA256 3d5e5da6b153a708b046f4886bc2942fdc77e55b18c8af3c16cf69621609c97e
- MD5 2c9073237ffd53c18560322e25f10b2f
- SHA1 6ca4524eed322a324290f092b6e802b7b60ebe9b
- SHA512 36b28fd130ff6ce820ef135d1d2a7f74817d3ea8dc6f5222e0b09639984906b712b99202d09059e3b5324a456d474a69a68d2d711dedff3fa50f623f8046fec0
- TLSH
  T1B541302279F166498810D0E0A3A17E276CD0C123C7068850F5EE26BE1FDDCC3996BBBC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  .rsrc/1033/HTML/IDR_OEMPG_FI.HTML
- Size 1KB
- SHA256 4073896ec571599f825a3c28cdf46bf31d70516e8f97edeb56e6a0788a85ec43
- MD5 40ec0cddc7068dfccd28d09312b53905
- SHA1 4991ab33ee8efc3ef35786134a543645596b19dd
- SHA512 2080560c0da6c962a9dbdcc31d993d3fbde5b50906476db29c107568fbf05dcfb7f398476b3540dcb964258ce9a1fe4e38ea63c02b95eb9808cc4f5e5160ad84
- TLSH
  T1BF41622235F1664E8614C0D8B3907E261DD0C533CB064850F1AE56F94FEDC83A927BAC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  .rsrc/1033/HTML/IDR_OEMPG_FIL.HTML
- Size 1KB
- SHA256 2f5e09a0188f6516f658c435f4a96231993fbb32bf86491699093b246c880257
- MD5 911a5293db0d2053d6eb7a3ca43d0761
- SHA1 a14399b864e4c564cdea9a36d1912205f44353b0
- SHA512 500f8c42424392574a5f91a4e17c1858cc02078a5c9b237ca6e83566e887a8410842d2c63b3d4bc018743d5c3419b6eb3b8e799e6c9a4fb7209e0511658ea2a9
- TLSH
  T1D141321275B1274D9A80D0E1A3A2BE162DD0C423D7461464F1FE12BB1FCEC83947B7AC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32