2026-07-06_9fe505c8bd2d32a1455e01ed9a7c23c6_elex_maze_stealc

General

Target
2026-07-06_9fe505c8bd2d32a1455e01ed9a7c23c6_elex_maze_stealc
Size 1.1MB
Sample260706-wf3dxaew3m
SHA256 7b1bc333d4138496540fb4eb580154856aa4451cac08b61e08ba592324255c35
MD5 9fe505c8bd2d32a1455e01ed9a7c23c6
SHA1 85e6fd592b27397521f15fffcb3ed6b8a2df2576
SHA512 122764b8c971baff84fee15c7d82f2684cb5f8610f4f2a318095fd01e837fcb4c482287b21b5537b887b92b2f2a7f3797a1fb54f312bf15b49b2a4e815d550aa
SSDEEP 24576:x9OJRvV22XaIZtcoBrtKc42spTHTMy8N8:x9KrpBrt6pT
TLSH
T187356BE1B571C0F0E8A91072A9BEBD5797399170073524D393BB4C8D6A332D11BBB3A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_9fe505c8bd2d32a1455e01ed9a7c23c6_elex_maze_stealc

File Explorer

2026-07-06_9fe505c8bd2d32a1455e01ed9a7c23c6_elex_maze_stealc

.exe 1.1MB

2026-07-06_9fe505c8bd2d32a1455e01ed9a7c23c6_elex_maze_stealc

IMPHASH 9baf9911d3d7a87d159cf663ca4b33b0
SHA256 7b1bc333d4138496540fb4eb580154856aa4451cac08b61e08ba592324255c35
MD5 9fe505c8bd2d32a1455e01ed9a7c23c6
SHA1 85e6fd592b27397521f15fffcb3ed6b8a2df2576
SHA512 122764b8c971baff84fee15c7d82f2684cb5f8610f4f2a318095fd01e837fcb4c482287b21b5537b887b92b2f2a7f3797a1fb54f312bf15b49b2a4e815d550aa
SSDEEP 24576:x9OJRvV22XaIZtcoBrtKc42spTHTMy8N8:x9KrpBrt6pT
TLSH
T187356BE1B571C0F0E8A91072A9BEBD5797399170073524D393BB4C8D6A332D11BBB3A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

618272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\AlienCow\Tools\propper\mp\src\utils\propper\Release\vbsp.pdb

advapi32

GetUserNameA

tier0

Msg Warning Error GetCPUInformation WriteMiniDumpUsingExceptionInfo GetSpewOutputColor SpewOutputFunc ?DevMsg@@YAXPBDZZ CommandLine_Tier0 SpewActivate WriteMiniDump Plat_IsInDebugSession ColorSpewMessage Plat_FloatTime ??0CThreadSpinRWLock@@QAE@XZ ?LockForRead@CThreadSpinRWLock@@QAEXXZ ?UnlockRead@CThreadSpinRWLock@@QAEXXZ ?LockForWrite@CThreadSpinRWLock@@QAEXXZ ?UnlockWrite@CThreadSpinRWLock@@QAEXXZ DevMsg COM_TimestampedLog ?DevWarning@@YAXPBDZZ CreateSimpleThread ReleaseThreadHandle GetThreadedLoadLibraryFunc ThreadWaitForObjects g_pMemAlloc

vstdlib

RandomGaussianFloat KeyValuesSystem RandomSeed

kernel32

ReadConsoleInputA GetExitCodeThread HeapFree SetEndOfFile OutputDebugStringW GetExitCodeProcess CreateFileW WriteConsoleW SetStdHandle LoadLibraryExW FreeEnvironmentStringsW GetEnvironmentStringsW VirtualQuery HeapAlloc GetProcessHeap GetCurrentProcess TerminateProcess GetModuleFileNameA GetLastError WaitForSingleObject CloseHandle CreateProcessA CreateDirectoryA WriteFile ReadFile FlushFileBuffers SetFilePointer GetLocalTime CreateFileA DeleteFileA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetStdHandle OutputDebugStringA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetModuleHandleA CreateThread SetThreadPriority WaitForMultipleObjects GetSystemInfo SetPriorityClass SetUnhandledExceptionFilter GetFileAttributesA MultiByteToWideChar WideCharToMultiByte GetCurrentThreadId FreeLibrary GetProcAddress LoadLibraryExA DeleteCriticalSection GetStringTypeW RaiseException RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent GetTempPathA GetDriveTypeW GetFullPathNameA GetCommandLineA SetEnvironmentVariableA GetSystemTimeAsFileTime GetCPInfo UnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW AreFileApisANSI GetFileType IsValidCodePage GetACP GetOEMCP GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx GetCurrentProcessId GetCurrentDirectoryW SetEnvironmentVariableW GetFileAttributesExW GetModuleFileNameW QueryPerformanceCounter SetConsoleMode

generic

count=6, id=199, version=41118,

count=45, id=223, productName=VS2013 build 21005, version=21005,

count=84, id=225, productName=VS2013 build 21005, version=21005,

count=266, id=224, productName=VS2013 build 21005, version=21005,

count=4, id=221, productName=VS2013 UPD3 build 30723, version=30723,

count=1, id=158, productName=VS2010 build 30319, version=30319,

count=3, id=170, productName=VS2010 build 30319, version=30319,

count=48, id=171, productName=VS2010 build 30319, version=30319,

count=2, id=49, version=9044,

count=9, id=225, productName=VS2013 UPD3 build 30723, version=30723,

count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=163, id=1, productName=Unmarked objects,

count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,

count=78, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_9fe505c8bd2d32a1455e01ed9a7c23c6_elex_maze_stealc

advapi32

tier0

vstdlib

kernel32

generic