2026-07-27_30ddcfdfae431f85c37ebb17c60fe240_elex_mafia_stealc_tofsee

General

Target
2026-07-27_30ddcfdfae431f85c37ebb17c60fe240_elex_mafia_stealc_tofsee
Size 411KB
Sample260727-qlrayatbqe
SHA256 e8daa2cc6c592961578283ea7be9519aaa661201adba47e550146f3a9e3f4ccd
MD5 30ddcfdfae431f85c37ebb17c60fe240
SHA1 b1b2216450db2ca1b1cf844450ad331c43053044
SHA512 d16edf671e7d4ab21b3746feb128225e9b391843e55f87bb2aac8e723b20a130ba899239f72ea5aef33e55a09d3a7e2f0451216aac2361a3d1678ff272b2907d
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFyoNRtyNlhOoVJW7hBwtAPJsrqHI:gZLolhNVyEruRtyNLOoVJkBw+2qHI
TLSH
T1EE94DF24B281C036D19704318AF6D776653A7DB25B62A4CBB3983B7D1FB03D1667A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_30ddcfdfae431f85c37ebb17c60fe240_elex_mafia_stealc_tofsee

File Explorer

2026-07-27_30ddcfdfae431f85c37ebb17c60fe240_elex_mafia_stealc_tofsee

.exe 411KB

2026-07-27_30ddcfdfae431f85c37ebb17c60fe240_elex_mafia_stealc_tofsee

IMPHASH 6dca3e9fb3928bbdb54dbce669943ec8
SHA256 e8daa2cc6c592961578283ea7be9519aaa661201adba47e550146f3a9e3f4ccd
MD5 30ddcfdfae431f85c37ebb17c60fe240
SHA1 b1b2216450db2ca1b1cf844450ad331c43053044
SHA512 d16edf671e7d4ab21b3746feb128225e9b391843e55f87bb2aac8e723b20a130ba899239f72ea5aef33e55a09d3a7e2f0451216aac2361a3d1678ff272b2907d
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFyoNRtyNlhOoVJW7hBwtAPJsrqHI:gZLolhNVyEruRtyNLOoVJkBw+2qHI
TLSH
T1EE94DF24B281C036D19704318AF6D776653A7DB25B62A4CBB3983B7D1FB03D1667A30B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

70614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetComputerNameW GetLocalTime SystemTimeToFileTime FileTimeToSystemTime SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar GetProcAddress LoadLibraryW GetCurrentProcess LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetLastError CloseHandle WideCharToMultiByte MoveFileW DeleteFileW CreateDirectoryW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW lstrlenW CreateFileW GetFileSize ReadFile WriteFile Sleep GetComputerNameA GetModuleFileNameW CreateProcessW GetSystemTime FileTimeToLocalFileTime RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalAlloc SetEndOfFile SetStdHandle WriteConsoleW FreeLibrary LoadLibraryA InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentThreadId RtlUnwind LCMapStringW GetCPInfo SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage SetFilePointer FlushFileBuffers GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW

ole32

CoCreateInstance CoInitialize

shlwapi

PathIsRootW PathFileExistsW PathAppendW PathAddExtensionW PathRemoveExtensionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_30ddcfdfae431f85c37ebb17c60fe240_elex_mafia_stealc_tofsee

kernel32

ole32

shlwapi

generic