2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee
Size 12.7MB
Sample260711-xh5sgsbv21
SHA256 f8f0b2233b4e3db8d5d8cdbbe0bf2f237a1e1e90b52cdfbcff478689e09209ac
MD5 26ad383d9e965d92ffc83bfa1fd432b6
SHA1 3fcd76b4969e648d92ab5ccddf26199cd96840ac
SHA512 d98d739c3e62ae1b5de35a9d8ff75c01077f07cd50ee5ac632c81ea1e894aa2afc3b2910558824e3f31226923fc98eafb984c0c9ba868664435f2085731ead97
SSDEEP 6144:0btuAUl9S+pHmwJmFsXfGdNpKwttZYQDmFA+LOG9nEvpJamvLL0KsH8p:0SgcmFsXfGdfzYQCFA+Lu3BLLkcp
TLSH
T141D6E1227582C032E6E706754BE5CB65297ABE255B22B0CB779037AD6F703D1EA34307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee

File Explorer

2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee

.exe 12.7MB

2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee

IMPHASH 68fd9a4119e9a7015025259c92860f5c
SHA256 f8f0b2233b4e3db8d5d8cdbbe0bf2f237a1e1e90b52cdfbcff478689e09209ac
MD5 26ad383d9e965d92ffc83bfa1fd432b6
SHA1 3fcd76b4969e648d92ab5ccddf26199cd96840ac
SHA512 d98d739c3e62ae1b5de35a9d8ff75c01077f07cd50ee5ac632c81ea1e894aa2afc3b2910558824e3f31226923fc98eafb984c0c9ba868664435f2085731ead97
SSDEEP 6144:0btuAUl9S+pHmwJmFsXfGdNpKwttZYQDmFA+LOG9nEvpJamvLL0KsH8p:0SgcmFsXfGdfzYQCFA+Lu3BLLkcp
TLSH
T141D6E1227582C032E6E706754BE5CB65297ABE255B22B0CB779037AD6F703D1EA34307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetLocalTime GetComputerNameW SystemTimeToFileTime FileTimeToSystemTime SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar GetProcAddress LoadLibraryW GetCurrentProcess LeaveCriticalSection EnterCriticalSection DeleteCriticalSection WaitForSingleObject InitializeCriticalSection GetLastError CloseHandle WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess TerminateProcess Sleep MoveFileW DeleteFileW CreateDirectoryW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW lstrlenW CreateFileW GetFileSize ReadFile WriteFile GetComputerNameA GetModuleFileNameW CreateProcessW GetSystemTime FileTimeToLocalFileTime RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalAlloc LoadLibraryA WaitForMultipleObjects GetModuleHandleA ProcessIdToSessionId SetEndOfFile SetStdHandle WriteConsoleW FreeLibrary GetStringTypeW IsValidLocale InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW ExitThread GetCurrentThreadId CreateThread RtlUnwind LCMapStringW GetCPInfo SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage SetFilePointer FlushFileBuffers GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA EnumSystemLocalesA

ole32

CoCreateInstance CoInitialize

shlwapi

PathAppendW PathAddExtensionW PathFileExistsW PathRemoveExtensionW PathIsRootW

psapi

GetModuleFileNameExW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee

kernel32

ole32

shlwapi

psapi

userenv

generic