General
- Target 2026-07-05_fba2b26b1916b80aafff44b37382d0c7_elex_smoke-loader_stealc_stop_tofsee
- Size 1.7MB
- Sample260705-fa8ezac18l
- SHA256 e71007a53856283178fb370d69a77c59219b56f49c377d730ecaa14ec1e6176f
- MD5 fba2b26b1916b80aafff44b37382d0c7
- SHA1 c59d22f5c77ad71d81b7015469c1812ce39ff42f
- SHA512 0b23d40c283fec18cca2c1e46d31d33af8e6051faf859211fdac99bbeff3865dd2a937d9a1e097f2cc6264ea80f86d81715556feac45ff10f8d272aa20254f0c
- SSDEEP 12288:SwKfOVRo9yRYFbG9+l00VUsvFFkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkz:SxWVeyRY1GguQMyIyOxz
- TLSH T18A853805BFFD8045F5B767709D7256A10A66BC22FE74C51F72483B0EEAB0B418826B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-05_fba2b26b1916b80aafff44b37382d0c7_elex_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-05_fba2b26b1916b80aafff44b37382d0c7_elex_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260629-en
Malware Config
Targets
-
- Target 2026-07-05_fba2b26b1916b80aafff44b37382d0c7_elex_smoke-loader_stealc_stop_tofsee
- Size 1.7MB
- SHA256 e71007a53856283178fb370d69a77c59219b56f49c377d730ecaa14ec1e6176f
- MD5 fba2b26b1916b80aafff44b37382d0c7
- SHA1 c59d22f5c77ad71d81b7015469c1812ce39ff42f
- SHA512 0b23d40c283fec18cca2c1e46d31d33af8e6051faf859211fdac99bbeff3865dd2a937d9a1e097f2cc6264ea80f86d81715556feac45ff10f8d272aa20254f0c
- SSDEEP 12288:SwKfOVRo9yRYFbG9+l00VUsvFFkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkz:SxWVeyRY1GguQMyIyOxz
- TLSH T18A853805BFFD8045F5B767709D7256A10A66BC22FE74C51F72483B0EEAB0B418826B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1