2026-07-15_b6c02831d80a20a0a1e995e4be7fa278_elex_mafia_stealc_tofsee

General

Target
2026-07-15_b6c02831d80a20a0a1e995e4be7fa278_elex_mafia_stealc_tofsee
Size 411KB
Sample260715-cl89vsct6y
SHA256 6aa1692b2e9fae4bc9e6dc1994d5a7cb100799c80b0c80d4a91ee64ae1952a8f
MD5 b6c02831d80a20a0a1e995e4be7fa278
SHA1 4cbb82f4fe6e39fa78b3a8cea2269c546396fa7c
SHA512 f18e7fe5217ab523b0e3bc7caf2c0b1a5c6d7b1800be02ded06ff351e5d05afd834417f635d1b4e74c8c20d8735aa49a2f0356a497a974d929ee5e5d682e9762
SSDEEP 12288:gZLolhNVyEssJ2zu2lPUmwyLVnDhIYqHI:gZqhOE7OulTylR
TLSH
T14394DF25B2C1C036D19700354BF6EB26193A7DB15B61A4CBB3D43B6E1E703D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_b6c02831d80a20a0a1e995e4be7fa278_elex_mafia_stealc_tofsee

File Explorer

2026-07-15_b6c02831d80a20a0a1e995e4be7fa278_elex_mafia_stealc_tofsee

.exe 411KB

2026-07-15_b6c02831d80a20a0a1e995e4be7fa278_elex_mafia_stealc_tofsee

IMPHASH 6dca3e9fb3928bbdb54dbce669943ec8
SHA256 6aa1692b2e9fae4bc9e6dc1994d5a7cb100799c80b0c80d4a91ee64ae1952a8f
MD5 b6c02831d80a20a0a1e995e4be7fa278
SHA1 4cbb82f4fe6e39fa78b3a8cea2269c546396fa7c
SHA512 f18e7fe5217ab523b0e3bc7caf2c0b1a5c6d7b1800be02ded06ff351e5d05afd834417f635d1b4e74c8c20d8735aa49a2f0356a497a974d929ee5e5d682e9762
SSDEEP 12288:gZLolhNVyEssJ2zu2lPUmwyLVnDhIYqHI:gZqhOE7OulTylR
TLSH
T14394DF25B2C1C036D19700354BF6EB26193A7DB15B61A4CBB3D43B6E1E703D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

70614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetComputerNameW GetLocalTime SystemTimeToFileTime FileTimeToSystemTime SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar GetProcAddress LoadLibraryW GetCurrentProcess LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetLastError CloseHandle WideCharToMultiByte MoveFileW DeleteFileW CreateDirectoryW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW lstrlenW CreateFileW GetFileSize ReadFile WriteFile Sleep GetComputerNameA GetModuleFileNameW CreateProcessW GetSystemTime FileTimeToLocalFileTime RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalAlloc SetEndOfFile SetStdHandle WriteConsoleW FreeLibrary LoadLibraryA InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentThreadId RtlUnwind LCMapStringW GetCPInfo SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage SetFilePointer FlushFileBuffers GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW

ole32

CoCreateInstance CoInitialize

shlwapi

PathIsRootW PathFileExistsW PathAppendW PathAddExtensionW PathRemoveExtensionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_b6c02831d80a20a0a1e995e4be7fa278_elex_mafia_stealc_tofsee

kernel32

ole32

shlwapi

generic