4d6e6708e95a0b17e793e4ac6e477e7cb0d19442d9c86473e5946606dae39205

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_9b7e3bd5bee7174a8c96e428dee81557_elex_smoke-loader_stealc_stop_tofsee
Size 3.8MB
Sample260707-cf4gesfx81
SHA256 4d6e6708e95a0b17e793e4ac6e477e7cb0d19442d9c86473e5946606dae39205
MD5 9b7e3bd5bee7174a8c96e428dee81557
SHA1 e94cb87eb7f44db0b9f6d30f3906ad567d54911a
SHA512 f4ed90848e0c9274c87e1b2008e820ccc0e7fb112c2594a0d93ec65ee6d00c38ed47d6a2b12ab64acb5264ab84124728ebe44b32e6ae47b2cf83fd683993abf2
SSDEEP 24576:QxWVeyRY9guQ2Ahbe4x4xM1MhTDplOz+xKF2RLWngE0pHa6ozFnNyr9UEK2HUQ:Q8Ye5j2xM1MQ6xKF+LWngB7GFM/K2HX
TLSH
T19A06F723DFBD8444D0268F35C82365A019332D5997AD5A0F1AA4B53F8EF37822A5773B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  2026-07-06_9b7e3bd5bee7174a8c96e428dee81557_elex_smoke-loader_stealc_stop_tofsee
- Size 3.8MB
- SHA256 4d6e6708e95a0b17e793e4ac6e477e7cb0d19442d9c86473e5946606dae39205
- MD5 9b7e3bd5bee7174a8c96e428dee81557
- SHA1 e94cb87eb7f44db0b9f6d30f3906ad567d54911a
- SHA512 f4ed90848e0c9274c87e1b2008e820ccc0e7fb112c2594a0d93ec65ee6d00c38ed47d6a2b12ab64acb5264ab84124728ebe44b32e6ae47b2cf83fd683993abf2
- SSDEEP 24576:QxWVeyRY9guQ2Ahbe4x4xM1MhTDplOz+xKF2RLWngE0pHa6ozFnNyr9UEK2HUQ:Q8Ye5j2xM1MQ6xKF+LWngB7GFM/K2HX
- TLSH
  T19A06F723DFBD8444D0268F35C82365A019332D5997AD5A0F1AA4B53F8EF37822A5773B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  .rsrc/1033/HTML/IDR_EULA_JSC.JS
- Size 534B
- SHA256 6b6fbea046f2b4b1115478b4146a71bfddbbdd1e2649fa710e906f68f48bb979
- MD5 bbc424e03b2f814e3141a698dfe2fe21
- SHA1 00becbc776af04bb77d255c388b1d699770baa7b
- SHA512 2c618c31ce46147d899a71f6557fef4ef95fcc53093385297c3016cf461d3198d3fc2a75a57f1f990d44bf47029753809e40ecd98a3a2bcdfc18b1e8f9b61975
- TLSH
  T1EBF0F66F34D614B1247FA435650BB35C347441103109CB81B1ACA1906DB0E23D13BBE8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  .rsrc/1033/HTML/IDR_OEMPG_AR.HTML
- Size 2KB
- SHA256 c5a76f481fedd2a98f620df242084e433532b500503473f8bb4221d3d4e04b12
- MD5 6c4ac1eb165de3ef72ab6b2011ea1627
- SHA1 dda0572869ee022ca47f8c9b8fd69c8dc6f34f5c
- SHA512 3449d69d579cbb87b5d76a77ffa63341451d787d727ac92097894df9719d9cd0727467e8fff4ae86c009a5b6f9fb5b1e309c4c281e518390fa9d073a445bb041
- TLSH
  T1424101623AB055294550D495E2D17E1ADCE19C23C707A860B0EF16B60FDDC8399AB7BC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral5 behavioral6
- Target
  .rsrc/1033/HTML/IDR_OEMPG_BG.HTML
- Size 2KB
- SHA256 3eca31effaccdf14d5bcfbb67b8a92303d87aba8dbc420f2e0a5905e99a7ed42
- MD5 9ab5923cf0b87f4b71bc1876241e6a0e
- SHA1 e41c9d1bcd75158c0fe6c691254f3c89120eabc1
- SHA512 47ab669e585552a1b8917dfd2c2f0c9402ddc016a55e81d87688014d6e1425e37842ca42be50cfc0053cd8cc7d2a8c16ef82f4810f68d8d7998f228842ac471f
- TLSH
  T19B41642235F22D8F4500E09DE5517E062DD2C97BEF434980B0AE16BE3FD9C8689AB75C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral7 behavioral8
- Target
  .rsrc/1033/HTML/IDR_OEMPG_CA.HTML
- Size 2KB
- SHA256 5f8bf4f5ea8fa5d72b7330d9573d74188fbff91589807c2240cdbace2dfabbf2
- MD5 de5d041b3805f4cc5c2453399567cef6
- SHA1 d5272e50c275949b926abeea22133856ef70e453
- SHA512 46f4f1b44162c6b2e43116c92f0a72fec99d2d5f6504a3512bebde25088d602ce06efb8939a4e2b299accdc3214cc5a3e55bcbc702b4e6de5496bd93e5abaaf3
- TLSH
  T10041322275F26A5E8900E0D0B6D2AE172DD1C123C70184A0F59E76BA1FDDC87947BBAC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  .rsrc/1033/HTML/IDR_OEMPG_CS.HTML
- Size 2KB
- SHA256 76dd86028a3a6f9e32209a8fe509bd88dd0d18b299e6997a9a979d8a4feb3a73
- MD5 40bfa2ec74cc5b9b871eb3cc76f0085a
- SHA1 f4e591a39c33455add340afb718739a173137e4f
- SHA512 dcb4ba5801c5ff683e05b30ab6363add4adce1e5e3f4f20b7f8bb531324d8f6f4c1f968229ad0d26a5dd26dc3bf8afaa68cac400b2a44418409376eac6642cdd
- TLSH
  T1EE41311A76E1A50A8640F0E0B7D16E037CD1C223C6464890F0AD96B60FDFCD3D967AAC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  .rsrc/1033/HTML/IDR_OEMPG_DA.HTML
- Size 1KB
- SHA256 927421687d6223f902f8098e4982b385bacec286a44c49651ba134c428b8d784
- MD5 492c40bc152664ceed2aa8569635056d
- SHA1 df1c1a30a779203851d0813b1fc5713bd4f182a7
- SHA512 8fabc4528cb6f31fa3e75a81dadac15c6af2246b2e32f956be2df209920b19805a0160e8dc27731d7de9dd78491136dcc3614eaf67ee1821879a3a6b557f4a6c
- TLSH
  T1AD41441274F1360F4950D0A17692AE2A6DD08127C74A08A4F4ED27BA1FCCCC7956FBAC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  .rsrc/1033/HTML/IDR_OEMPG_DE.HTML
- Size 2KB
- SHA256 3c41783180de7c2aac8485320f377b2e4be9a8eb9cfb5205a9a7cbca71308014
- MD5 0dcd4fd5f711ccd28700b64765fcb8cd
- SHA1 cdef17fca14d43c508d0912ffe94535da243a4f7
- SHA512 6ebe8264dd69154cbb529b6b91838659968415645f4b33eb62c1d46fba7578af0db7065278fb603c57b1a9861278152110a6d9f06c65d1d0aa2c023154275d57
- TLSH
  T1A5417613B5F1251A8951D1A0A3927F161DD18233C3495894F09E56BB0FDDC83996B7FC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral15 behavioral16
- Target
  .rsrc/1033/HTML/IDR_OEMPG_EL.HTML
- Size 3KB
- SHA256 5447bbc69a208a67e2feef337d83be510418f2acf0df2b4c8d88f3496f6574e2
- MD5 dc420f3f9884333499f55eda67b5dce9
- SHA1 ffc0380684d9e56a4d1cfdfbafef35354c9f2b86
- SHA512 8b2ba3611fb06c7b2b8a2f5d5628c4cebb5366cdfd02b7d2bb049fed5f87bda6f1a0649d76fbdc56d657d6c35d538bff0191ab096ce99b365365ea9309297345
- TLSH
  T1AC812B84745622C9DE0050C53C65BA7E4A7DC1B3FD12DAF1B0EF27464B85A8F3A4AF68
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  .rsrc/1033/HTML/IDR_OEMPG_EN.HTML
- Size 1KB
- SHA256 bf5276a41b68953043e8b73398ba7ec7b2c1281054afdff09f30d22252bd2d1d
- MD5 189359b34220b2174754607d0125635a
- SHA1 6f2edc0584aa00610cd93acf926b717e09f3b024
- SHA512 4d617dbfb9aecb74e300710651415c7b5aa9da7150efc7abc9134f175aa5da04667e9ffe83ae6cae5e8429cad8f34d2041a79e30ca2909018565f6f4b2c9b755
- TLSH
  T122413323B5F12B5A8950D0E0B695BE165DD08023C7464460F4DF26BA0FDDC83557BBED
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral19 behavioral20
- Target
  .rsrc/1033/HTML/IDR_OEMPG_EN_GB.HTML
- Size 1KB
- SHA256 8f01f7a012b0a9498bee7088666ee821b30b6ee5934b9cd5597956b420ef21a5
- MD5 a9e9162b52b85050c5dd7e813f2b2d4f
- SHA1 4b635f77c719a43c9fb485064a9df04e2d210454
- SHA512 92c025b502ae2596c3ada903f030fb699697092d2df1dcddf3f5248e542d5b1b8317c4468783a640a46cf9c4853fd8c5be6d75a0616804aae69aec9d71acee33
- TLSH
  T11B413123B5F1275A8910D0A0B695BE165DD18023C7464460F4EE26BA0FDDC83997BBAD
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  .rsrc/1033/HTML/IDR_OEMPG_ES.HTML
- Size 2KB
- SHA256 8d78dc394331628c68f395c651a8e65da3a6b3c03bed8e363b20d55ee22ec00b
- MD5 9e4d4882b1b11f476266dec6df6ee635
- SHA1 6922d0003d3e6e98ef802706402a9d8613d1eb33
- SHA512 38745fd38294206dc9239d2798fe27564feec80233522660adcdd76d2f18ed8335e70ba11b8aa6b36bb80cd795c30ad58be77f90dd31de3b5c72466fddadf98f
- TLSH
  T19241321379F56A4A4551E0A0B3D2AE17ADD1C123C70584B0F4AE62B60FDDC839467BEC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral23 behavioral24
- Target
  .rsrc/1033/HTML/IDR_OEMPG_ES_419.HTML
- Size 2KB
- SHA256 8d78dc394331628c68f395c651a8e65da3a6b3c03bed8e363b20d55ee22ec00b
- MD5 9e4d4882b1b11f476266dec6df6ee635
- SHA1 6922d0003d3e6e98ef802706402a9d8613d1eb33
- SHA512 38745fd38294206dc9239d2798fe27564feec80233522660adcdd76d2f18ed8335e70ba11b8aa6b36bb80cd795c30ad58be77f90dd31de3b5c72466fddadf98f
- TLSH
  T19241321379F56A4A4551E0A0B3D2AE17ADD1C123C70584B0F4AE62B60FDDC839467BEC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral25 behavioral26
- Target
  .rsrc/1033/HTML/IDR_OEMPG_ET.HTML
- Size 1KB
- SHA256 906afa9fc6c2eaeef833a5b4a332f516a153f362c8866e1f620e7968fc63cd1e
- MD5 89fb597db5954868f7ebab04954ac9ba
- SHA1 27692c981366bb42b6251ceb361437a0636f5b51
- SHA512 3be8d8c1d345dd6e3492b5b5ffd4afcc3ad254225083c93fbfc7a3033d9592cba8bae456be23314d618da4f5dc47f17e85a042992e2fee83c78cc6ba9027368b
- TLSH
  T19841442275B1220A8910D0E063927E1B6CD1C123C7064860F4EF2ABE5FDDC87996F7BC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral27 behavioral28
- Target
  .rsrc/1033/HTML/IDR_OEMPG_FI.HTML
- Size 2KB
- SHA256 361ade518ae544e07e92f8f633777d048d8bbd2e8c2cb8962de5588d0506c45d
- MD5 be68638e4fb463a9b7271813dddd58b8
- SHA1 d551b4759852624d98dbb37217292767185afdd6
- SHA512 f8b1fc01dd192a34588cd596c67caad911429afa7bf1011950e085a8bc17c94e122f570656f1f09cb4a93df96b0e819c01fa1a071a47f6f7d85bf84d296a6bf8
- TLSH
  T15C41012274A2250B8500D0D5A2D1BE162CE18323C70A8850F5AE57FB5FDDC8BA87777C
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  .rsrc/1033/HTML/IDR_OEMPG_FIL.HTML
- Size 2KB
- SHA256 67b5855ddb459ee5ba9fed40c0261e02443b18dcbc2857ef1ff4a3f52d5c1194
- MD5 a1244c6138e2ebda40eb99562c115497
- SHA1 5bb205db2f52f5712a1e081a2192f042e7f2ceae
- SHA512 6e039892671f758bd2a2e95d0adb6209dfe5e4947f5f59abc2899e5e87f00b305858154ed43c8808941c9857cbb638f21fbd4ec09843158c7d3a9622bc5019ab
- TLSH
  T11E414F12B9B127598A80C0E1A3A2BE061DC1C423D7421860F1FF16BA1FCEC8395377EC
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32