General
- Target 2026-07-09_c4da96ef0c8fcf68c3325ea0182438ae_elex_mafia_poet-rat_stealc_tofsee
- Size 1.8MB
- Sample260709-pderhaay8z
- SHA256 b63901cbb79ff4e442ad9ed58cd04b1f71f1ad912966cdd4f5d8a968c8d44954
- MD5 c4da96ef0c8fcf68c3325ea0182438ae
- SHA1 c40536ae096eec0c359b5afac8f5cc6db71674c4
- SHA512 71f30fa4c2932912c86346827f2d2fa3b061cb491fc1b77a40c224ed899fe04b00c6b6bbc2821989041ad0386e9630af2abe9b48dff62ed5e3c40a4d5e43e905
- SSDEEP 24576:wUQOJDyHI9DXngcxM+NGEAFC5etW0Ri+aMyFH1KN:w/OJDYisSM+NGEADt7i+/yTW
- TLSH T10495802277FD0608F2F75E752AB6F9504C7ABDA25D21D29D1078908E8D71B80DA63B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_c4da96ef0c8fcf68c3325ea0182438ae_elex_mafia_poet-rat_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_c4da96ef0c8fcf68c3325ea0182438ae_elex_mafia_poet-rat_stealc_tofsee.exe
Resource
win11ltsc2024-20260706-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_c4da96ef0c8fcf68c3325ea0182438ae_elex_mafia_poet-rat_stealc_tofsee
- Size 1.8MB
- SHA256 b63901cbb79ff4e442ad9ed58cd04b1f71f1ad912966cdd4f5d8a968c8d44954
- MD5 c4da96ef0c8fcf68c3325ea0182438ae
- SHA1 c40536ae096eec0c359b5afac8f5cc6db71674c4
- SHA512 71f30fa4c2932912c86346827f2d2fa3b061cb491fc1b77a40c224ed899fe04b00c6b6bbc2821989041ad0386e9630af2abe9b48dff62ed5e3c40a4d5e43e905
- SSDEEP 24576:wUQOJDyHI9DXngcxM+NGEAFC5etW0Ri+aMyFH1KN:w/OJDYisSM+NGEADt7i+/yTW
- TLSH T10495802277FD0608F2F75E752AB6F9504C7ABDA25D21D29D1078908E8D71B80DA63B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.