General
- Target 2026-06-27_1f01be6c19f1943c91f49a25d18d8569_elex_smoke-loader_stealc_stop_tofsee
- Size 1.2MB
- Sample260629-ld2pgshy8x
- SHA256 2d7cd44e709d72125c55c312bb8f48af4c76c46885e76ed04095505606164b11
- MD5 1f01be6c19f1943c91f49a25d18d8569
- SHA1 b5ae419f3d3bd28556b2c031138e095428b383ea
- SHA512 aeaa579c53e6228587a0ab927c9e986cac68ad9bc3d1ce7aebf722d94d0a3a67fe7b2d07323bb9843e7c706a82898729997a99ccdb4bdbc24b863bd83f701f5f
- SSDEEP 6144:CwynAtMrOVRkidy9yIGWlUi04tNAII1SLHco6FLY6shZBWlK3b++2kLDYQJUExH+:CwKfOVRo9yRYlteIGLUh7Wk/LY091IqC
- TLSH T13C45A341E2D09526D4660E35C9A68E70DB367F685EE387873E4C3F2D2AB23C1742761E
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-06-27_1f01be6c19f1943c91f49a25d18d8569_elex_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-06-27_1f01be6c19f1943c91f49a25d18d8569_elex_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260617-en
Malware Config
Targets
-
- Target 2026-06-27_1f01be6c19f1943c91f49a25d18d8569_elex_smoke-loader_stealc_stop_tofsee
- Size 1.2MB
- SHA256 2d7cd44e709d72125c55c312bb8f48af4c76c46885e76ed04095505606164b11
- MD5 1f01be6c19f1943c91f49a25d18d8569
- SHA1 b5ae419f3d3bd28556b2c031138e095428b383ea
- SHA512 aeaa579c53e6228587a0ab927c9e986cac68ad9bc3d1ce7aebf722d94d0a3a67fe7b2d07323bb9843e7c706a82898729997a99ccdb4bdbc24b863bd83f701f5f
- SSDEEP 6144:CwynAtMrOVRkidy9yIGWlUi04tNAII1SLHco6FLY6shZBWlK3b++2kLDYQJUExH+:CwKfOVRo9yRYlteIGLUh7Wk/LY091IqC
- TLSH T13C45A341E2D09526D4660E35C9A68E70DB367F685EE387873E4C3F2D2AB23C1742761E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1