9bc0f973418ca296b33f808b1c762ee981bcac0f9c99ae426c0df56f6ff5fe94

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_9574c86427591d2a5997161096c7c05b_elex_smoke-loader_stealc_stop_tofsee
Size 1.4MB
Sample260701-ea3ztafw7w
SHA256 9bc0f973418ca296b33f808b1c762ee981bcac0f9c99ae426c0df56f6ff5fe94
MD5 9574c86427591d2a5997161096c7c05b
SHA1 53ed2c92af86b4640eae7a0669531e89e973e660
SHA512 08b00182a754e600ea66d0359d858c5e82104baab19828b17351fcfe1a17d32d72c5db8071af8e6f8b536b567cc96a0d9adc0d00cf37465d398737a1d2cdc52d
SSDEEP 12288:4wKfOVRo9yRYYuYyox9+2FQ0LUxUHoTUsvFFkkkkkkkkkkkkkkkkkkkkkkkkkkkF:4xWVeyRYYr5xg2F3TQVCXaA
TLSH
T11D65F701BFFD8055F4BB27709C324AA50A72BC22FE75856F7248370EDAB1B414925B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  2026-06-30_9574c86427591d2a5997161096c7c05b_elex_smoke-loader_stealc_stop_tofsee
- Size 1.4MB
- SHA256 9bc0f973418ca296b33f808b1c762ee981bcac0f9c99ae426c0df56f6ff5fe94
- MD5 9574c86427591d2a5997161096c7c05b
- SHA1 53ed2c92af86b4640eae7a0669531e89e973e660
- SHA512 08b00182a754e600ea66d0359d858c5e82104baab19828b17351fcfe1a17d32d72c5db8071af8e6f8b536b567cc96a0d9adc0d00cf37465d398737a1d2cdc52d
- SSDEEP 12288:4wKfOVRo9yRYYuYyox9+2FQ0LUxUHoTUsvFFkkkkkkkkkkkkkkkkkkkkkkkkkkkF:4xWVeyRYYr5xg2F3TQVCXaA
- TLSH
  T11D65F701BFFD8055F4BB27709C324AA50A72BC22FE75856F7248370EDAB1B414925B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence adware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  .rsrc/1033/HTML/IDR_EULA_JSC.JS
- Size 534B
- SHA256 6b6fbea046f2b4b1115478b4146a71bfddbbdd1e2649fa710e906f68f48bb979
- MD5 bbc424e03b2f814e3141a698dfe2fe21
- SHA1 00becbc776af04bb77d255c388b1d699770baa7b
- SHA512 2c618c31ce46147d899a71f6557fef4ef95fcc53093385297c3016cf461d3198d3fc2a75a57f1f990d44bf47029753809e40ecd98a3a2bcdfc18b1e8f9b61975
- TLSH
  T1EBF0F66F34D614B1247FA435650BB35C347441103109CB81B1ACA1906DB0E23D13BBE8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  .rsrc/1033/HTML/IDR_OEMPG_AR.HTML
- Size 2KB
- SHA256 c5a76f481fedd2a98f620df242084e433532b500503473f8bb4221d3d4e04b12
- MD5 6c4ac1eb165de3ef72ab6b2011ea1627
- SHA1 dda0572869ee022ca47f8c9b8fd69c8dc6f34f5c
- SHA512 3449d69d579cbb87b5d76a77ffa63341451d787d727ac92097894df9719d9cd0727467e8fff4ae86c009a5b6f9fb5b1e309c4c281e518390fa9d073a445bb041
- TLSH
  T1424101623AB055294550D495E2D17E1ADCE19C23C707A860B0EF16B60FDDC8399AB7BC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  .rsrc/1033/HTML/IDR_OEMPG_BG.HTML
- Size 2KB
- SHA256 3eca31effaccdf14d5bcfbb67b8a92303d87aba8dbc420f2e0a5905e99a7ed42
- MD5 9ab5923cf0b87f4b71bc1876241e6a0e
- SHA1 e41c9d1bcd75158c0fe6c691254f3c89120eabc1
- SHA512 47ab669e585552a1b8917dfd2c2f0c9402ddc016a55e81d87688014d6e1425e37842ca42be50cfc0053cd8cc7d2a8c16ef82f4810f68d8d7998f228842ac471f
- TLSH
  T19B41642235F22D8F4500E09DE5517E062DD2C97BEF434980B0AE16BE3FD9C8689AB75C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  .rsrc/1033/HTML/IDR_OEMPG_CA.HTML
- Size 2KB
- SHA256 5f8bf4f5ea8fa5d72b7330d9573d74188fbff91589807c2240cdbace2dfabbf2
- MD5 de5d041b3805f4cc5c2453399567cef6
- SHA1 d5272e50c275949b926abeea22133856ef70e453
- SHA512 46f4f1b44162c6b2e43116c92f0a72fec99d2d5f6504a3512bebde25088d602ce06efb8939a4e2b299accdc3214cc5a3e55bcbc702b4e6de5496bd93e5abaaf3
- TLSH
  T10041322275F26A5E8900E0D0B6D2AE172DD1C123C70184A0F59E76BA1FDDC87947BBAC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  .rsrc/1033/HTML/IDR_OEMPG_CS.HTML
- Size 2KB
- SHA256 76dd86028a3a6f9e32209a8fe509bd88dd0d18b299e6997a9a979d8a4feb3a73
- MD5 40bfa2ec74cc5b9b871eb3cc76f0085a
- SHA1 f4e591a39c33455add340afb718739a173137e4f
- SHA512 dcb4ba5801c5ff683e05b30ab6363add4adce1e5e3f4f20b7f8bb531324d8f6f4c1f968229ad0d26a5dd26dc3bf8afaa68cac400b2a44418409376eac6642cdd
- TLSH
  T1EE41311A76E1A50A8640F0E0B7D16E037CD1C223C6464890F0AD96B60FDFCD3D967AAC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  .rsrc/1033/HTML/IDR_OEMPG_DA.HTML
- Size 1KB
- SHA256 927421687d6223f902f8098e4982b385bacec286a44c49651ba134c428b8d784
- MD5 492c40bc152664ceed2aa8569635056d
- SHA1 df1c1a30a779203851d0813b1fc5713bd4f182a7
- SHA512 8fabc4528cb6f31fa3e75a81dadac15c6af2246b2e32f956be2df209920b19805a0160e8dc27731d7de9dd78491136dcc3614eaf67ee1821879a3a6b557f4a6c
- TLSH
  T1AD41441274F1360F4950D0A17692AE2A6DD08127C74A08A4F4ED27BA1FCCCC7956FBAC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  .rsrc/1033/HTML/IDR_OEMPG_DE.HTML
- Size 2KB
- SHA256 3c41783180de7c2aac8485320f377b2e4be9a8eb9cfb5205a9a7cbca71308014
- MD5 0dcd4fd5f711ccd28700b64765fcb8cd
- SHA1 cdef17fca14d43c508d0912ffe94535da243a4f7
- SHA512 6ebe8264dd69154cbb529b6b91838659968415645f4b33eb62c1d46fba7578af0db7065278fb603c57b1a9861278152110a6d9f06c65d1d0aa2c023154275d57
- TLSH
  T1A5417613B5F1251A8951D1A0A3927F161DD18233C3495894F09E56BB0FDDC83996B7FC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  .rsrc/1033/HTML/IDR_OEMPG_EL.HTML
- Size 3KB
- SHA256 5447bbc69a208a67e2feef337d83be510418f2acf0df2b4c8d88f3496f6574e2
- MD5 dc420f3f9884333499f55eda67b5dce9
- SHA1 ffc0380684d9e56a4d1cfdfbafef35354c9f2b86
- SHA512 8b2ba3611fb06c7b2b8a2f5d5628c4cebb5366cdfd02b7d2bb049fed5f87bda6f1a0649d76fbdc56d657d6c35d538bff0191ab096ce99b365365ea9309297345
- TLSH
  T1AC812B84745622C9DE0050C53C65BA7E4A7DC1B3FD12DAF1B0EF27464B85A8F3A4AF68
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  .rsrc/1033/HTML/IDR_OEMPG_EN.HTML
- Size 1KB
- SHA256 bf5276a41b68953043e8b73398ba7ec7b2c1281054afdff09f30d22252bd2d1d
- MD5 189359b34220b2174754607d0125635a
- SHA1 6f2edc0584aa00610cd93acf926b717e09f3b024
- SHA512 4d617dbfb9aecb74e300710651415c7b5aa9da7150efc7abc9134f175aa5da04667e9ffe83ae6cae5e8429cad8f34d2041a79e30ca2909018565f6f4b2c9b755
- TLSH
  T122413323B5F12B5A8950D0E0B695BE165DD08023C7464460F4DF26BA0FDDC83557BBED
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  .rsrc/1033/HTML/IDR_OEMPG_EN_GB.HTML
- Size 1KB
- SHA256 8f01f7a012b0a9498bee7088666ee821b30b6ee5934b9cd5597956b420ef21a5
- MD5 a9e9162b52b85050c5dd7e813f2b2d4f
- SHA1 4b635f77c719a43c9fb485064a9df04e2d210454
- SHA512 92c025b502ae2596c3ada903f030fb699697092d2df1dcddf3f5248e542d5b1b8317c4468783a640a46cf9c4853fd8c5be6d75a0616804aae69aec9d71acee33
- TLSH
  T11B413123B5F1275A8910D0A0B695BE165DD18023C7464460F4EE26BA0FDDC83997BBAD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  .rsrc/1033/HTML/IDR_OEMPG_ES.HTML
- Size 2KB
- SHA256 8d78dc394331628c68f395c651a8e65da3a6b3c03bed8e363b20d55ee22ec00b
- MD5 9e4d4882b1b11f476266dec6df6ee635
- SHA1 6922d0003d3e6e98ef802706402a9d8613d1eb33
- SHA512 38745fd38294206dc9239d2798fe27564feec80233522660adcdd76d2f18ed8335e70ba11b8aa6b36bb80cd795c30ad58be77f90dd31de3b5c72466fddadf98f
- TLSH
  T19241321379F56A4A4551E0A0B3D2AE17ADD1C123C70584B0F4AE62B60FDDC839467BEC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  .rsrc/1033/HTML/IDR_OEMPG_ES_419.HTML
- Size 2KB
- SHA256 8d78dc394331628c68f395c651a8e65da3a6b3c03bed8e363b20d55ee22ec00b
- MD5 9e4d4882b1b11f476266dec6df6ee635
- SHA1 6922d0003d3e6e98ef802706402a9d8613d1eb33
- SHA512 38745fd38294206dc9239d2798fe27564feec80233522660adcdd76d2f18ed8335e70ba11b8aa6b36bb80cd795c30ad58be77f90dd31de3b5c72466fddadf98f
- TLSH
  T19241321379F56A4A4551E0A0B3D2AE17ADD1C123C70584B0F4AE62B60FDDC839467BEC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  .rsrc/1033/HTML/IDR_OEMPG_ET.HTML
- Size 1KB
- SHA256 906afa9fc6c2eaeef833a5b4a332f516a153f362c8866e1f620e7968fc63cd1e
- MD5 89fb597db5954868f7ebab04954ac9ba
- SHA1 27692c981366bb42b6251ceb361437a0636f5b51
- SHA512 3be8d8c1d345dd6e3492b5b5ffd4afcc3ad254225083c93fbfc7a3033d9592cba8bae456be23314d618da4f5dc47f17e85a042992e2fee83c78cc6ba9027368b
- TLSH
  T19841442275B1220A8910D0E063927E1B6CD1C123C7064860F4EF2ABE5FDDC87996F7BC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  .rsrc/1033/HTML/IDR_OEMPG_FI.HTML
- Size 2KB
- SHA256 361ade518ae544e07e92f8f633777d048d8bbd2e8c2cb8962de5588d0506c45d
- MD5 be68638e4fb463a9b7271813dddd58b8
- SHA1 d551b4759852624d98dbb37217292767185afdd6
- SHA512 f8b1fc01dd192a34588cd596c67caad911429afa7bf1011950e085a8bc17c94e122f570656f1f09cb4a93df96b0e819c01fa1a071a47f6f7d85bf84d296a6bf8
- TLSH
  T15C41012274A2250B8500D0D5A2D1BE162CE18323C70A8850F5AE57FB5FDDC8BA87777C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  .rsrc/1033/HTML/IDR_OEMPG_FIL.HTML
- Size 2KB
- SHA256 67b5855ddb459ee5ba9fed40c0261e02443b18dcbc2857ef1ff4a3f52d5c1194
- MD5 a1244c6138e2ebda40eb99562c115497
- SHA1 5bb205db2f52f5712a1e081a2192f042e7f2ceae
- SHA512 6e039892671f758bd2a2e95d0adb6209dfe5e4947f5f59abc2899e5e87f00b305858154ed43c8808941c9857cbb638f21fbd4ec09843158c7d3a9622bc5019ab
- TLSH
  T11E414F12B9B127598A80C0E1A3A2BE061DC1C423D7421860F1FF16BA1FCEC8395377EC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral31 behavioral32