General
- Target 2026-07-05_c9c8a77d87ca5d59395ce3b065b10290_elex_mafia_poet-rat_stealc_tofsee
- Size 3.6MB
- Sample260705-vkhpmad19z
- SHA256 4efb2f7af4f179c4293f804a5a0d7b07fa307b5fbb05dcb41741e241722bfb6e
- MD5 c9c8a77d87ca5d59395ce3b065b10290
- SHA1 74c2c91dd7d3eb3db120e8963aadc54b95ce1694
- SHA512 be6b59ec6ea08a2610957367d95aacbac977581063766ec303e1f484683df5f4a1dd8df01eeab90f8e19bb2853e7a07ac9a77a93b773176821bd410ab8eec9d5
- SSDEEP 49152:w/OJDfdXUe0WNGEADt7i+/yTukuFGNLrkBirx:EOldXR0WchrSiGdkBirx
- TLSH T13706931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-05_c9c8a77d87ca5d59395ce3b065b10290_elex_mafia_poet-rat_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_c9c8a77d87ca5d59395ce3b065b10290_elex_mafia_poet-rat_stealc_tofsee.exe
Resource
win11ltsc2024-20260629-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-05_c9c8a77d87ca5d59395ce3b065b10290_elex_mafia_poet-rat_stealc_tofsee
- Size 3.6MB
- SHA256 4efb2f7af4f179c4293f804a5a0d7b07fa307b5fbb05dcb41741e241722bfb6e
- MD5 c9c8a77d87ca5d59395ce3b065b10290
- SHA1 74c2c91dd7d3eb3db120e8963aadc54b95ce1694
- SHA512 be6b59ec6ea08a2610957367d95aacbac977581063766ec303e1f484683df5f4a1dd8df01eeab90f8e19bb2853e7a07ac9a77a93b773176821bd410ab8eec9d5
- SSDEEP 49152:w/OJDfdXUe0WNGEADt7i+/yTukuFGNLrkBirx:EOldXR0WchrSiGdkBirx
- TLSH T13706931137FAC635F2BF8B356EB2E694197BF9A29D51C25F2069424E1C35B408E23732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.