2026-07-10_544255aa73a51d949a2590ec2eb95f3c_elex_mafia_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_544255aa73a51d949a2590ec2eb95f3c_elex_mafia_stealc_tofsee
Size 462KB
Sample260710-2mk14adt7m
SHA256 e8cf6d421c03f23a07cdd6538dd26da9c98681663abf1102f7884ee9f0892701
MD5 544255aa73a51d949a2590ec2eb95f3c
SHA1 37e2974809183c1f478c4bf38e4589e8387f323d
SHA512 cbc1a72600490680d6e9d13d74617389bb3e27ea35949ef1f5fa3f300e34ac501ad6d08829c322691df49810989feb958add5375504f5af6164c0e06bff1594c
SSDEEP 6144:zRPu8zwNAZYCZrIik3tHC8lh9DAQ5lEEUQpLLmZ8MijDKD+zk+TXiBYilSsH5f:zJrIik3E8lh9Dt/LZLQ8MyDzTZOj9
TLSH
T17FA4E0317A85C032E1E612714BE5CBA1697EBE36A72264C72B84377D6EB13C19B74307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_544255aa73a51d949a2590ec2eb95f3c_elex_mafia_stealc_tofsee

File Explorer

2026-07-10_544255aa73a51d949a2590ec2eb95f3c_elex_mafia_stealc_tofsee

.exe 462KB

2026-07-10_544255aa73a51d949a2590ec2eb95f3c_elex_mafia_stealc_tofsee

IMPHASH 2db4fba7eea2d94ca8042891d0a35f45
SHA256 e8cf6d421c03f23a07cdd6538dd26da9c98681663abf1102f7884ee9f0892701
MD5 544255aa73a51d949a2590ec2eb95f3c
SHA1 37e2974809183c1f478c4bf38e4589e8387f323d
SHA512 cbc1a72600490680d6e9d13d74617389bb3e27ea35949ef1f5fa3f300e34ac501ad6d08829c322691df49810989feb958add5375504f5af6164c0e06bff1594c
SSDEEP 6144:zRPu8zwNAZYCZrIik3tHC8lh9DAQ5lEEUQpLLmZ8MijDKD+zk+TXiBYilSsH5f:zJrIik3E8lh9Dt/LZLQ8MyDzTZOj9
TLSH
T17FA4E0317A85C032E1E612714BE5CBA1697EBE36A72264C72B84377D6EB13C19B74307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetLocalTime GetComputerNameW SystemTimeToFileTime FileTimeToSystemTime SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar GetProcAddress LoadLibraryW GetCurrentProcess LeaveCriticalSection EnterCriticalSection DeleteCriticalSection WaitForSingleObject InitializeCriticalSection GetLastError CloseHandle WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess TerminateProcess Sleep MoveFileW DeleteFileW CreateDirectoryW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW lstrlenW CreateFileW GetFileSize ReadFile WriteFile GetComputerNameA GetModuleFileNameW CreateProcessW GetSystemTime FileTimeToLocalFileTime RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalAlloc WaitForMultipleObjects GetModuleHandleA ProcessIdToSessionId SetEndOfFile SetStdHandle WriteConsoleW LoadLibraryA FreeLibrary GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW ExitThread GetCurrentThreadId CreateThread RtlUnwind LCMapStringW GetCPInfo SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage SetFilePointer FlushFileBuffers GetUserDefaultLCID GetLocaleInfoW

ole32

CoCreateInstance CoInitialize

shlwapi

PathFileExistsW PathIsRootW PathAppendW PathAddExtensionW PathRemoveExtensionW

psapi

GetModuleFileNameExW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_544255aa73a51d949a2590ec2eb95f3c_elex_mafia_stealc_tofsee

kernel32

ole32

shlwapi

psapi

wtsapi32

userenv

generic