2026-07-29_065ebdd546b8bd1649ff6150f74c2d1d_elex_mafia_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_065ebdd546b8bd1649ff6150f74c2d1d_elex_mafia_stealc_tofsee
Size 462KB
Sample260729-wye2bsch22
SHA256 b18793dc302d7f9e5143deb9d176f3aa543b45214acfe098797b2e4b0138fbb3
MD5 065ebdd546b8bd1649ff6150f74c2d1d
SHA1 e651ce03ad1a12a0f9f470fbdbfe563473d5875b
SHA512 10eeadbe632aa10403de433720e248ee9cd58de030f3da6db38d3720f88956cb10b9b76864703b65cf6b1e3db20ed619fec5a25f0c1c8508637397c04efd679f
SSDEEP 6144:zRPu8zwNAZYCZrIik3tHz/golSmn8JRO2+pvt561A/9sYwgd2d75MwsH5f:zJrIik3B/golSxU2+Fv/9sYwgdSG9
TLSH
T17DA4E0217685C032E1E616750AE5CBB2657ABE36272264C73B8437BD6EB13C2DB74307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_065ebdd546b8bd1649ff6150f74c2d1d_elex_mafia_stealc_tofsee

File Explorer

2026-07-29_065ebdd546b8bd1649ff6150f74c2d1d_elex_mafia_stealc_tofsee

.exe 462KB

2026-07-29_065ebdd546b8bd1649ff6150f74c2d1d_elex_mafia_stealc_tofsee

IMPHASH 2db4fba7eea2d94ca8042891d0a35f45
SHA256 b18793dc302d7f9e5143deb9d176f3aa543b45214acfe098797b2e4b0138fbb3
MD5 065ebdd546b8bd1649ff6150f74c2d1d
SHA1 e651ce03ad1a12a0f9f470fbdbfe563473d5875b
SHA512 10eeadbe632aa10403de433720e248ee9cd58de030f3da6db38d3720f88956cb10b9b76864703b65cf6b1e3db20ed619fec5a25f0c1c8508637397c04efd679f
SSDEEP 6144:zRPu8zwNAZYCZrIik3tHz/golSmn8JRO2+pvt561A/9sYwgd2d75MwsH5f:zJrIik3B/golSxU2+Fv/9sYwgdSG9
TLSH
T17DA4E0217685C032E1E616750AE5CBB2657ABE36272264C73B8437BD6EB13C2DB74307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetLocalTime GetComputerNameW SystemTimeToFileTime FileTimeToSystemTime SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar GetProcAddress LoadLibraryW GetCurrentProcess LeaveCriticalSection EnterCriticalSection DeleteCriticalSection WaitForSingleObject InitializeCriticalSection GetLastError CloseHandle WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess TerminateProcess Sleep MoveFileW DeleteFileW CreateDirectoryW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW lstrlenW CreateFileW GetFileSize ReadFile WriteFile GetComputerNameA GetModuleFileNameW CreateProcessW GetSystemTime FileTimeToLocalFileTime RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalAlloc WaitForMultipleObjects GetModuleHandleA ProcessIdToSessionId SetEndOfFile SetStdHandle WriteConsoleW LoadLibraryA FreeLibrary GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW ExitThread GetCurrentThreadId CreateThread RtlUnwind LCMapStringW GetCPInfo SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage SetFilePointer FlushFileBuffers GetUserDefaultLCID GetLocaleInfoW

ole32

CoCreateInstance CoInitialize

shlwapi

PathFileExistsW PathIsRootW PathAppendW PathAddExtensionW PathRemoveExtensionW

psapi

GetModuleFileNameExW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_065ebdd546b8bd1649ff6150f74c2d1d_elex_mafia_stealc_tofsee

kernel32

ole32

shlwapi

psapi

wtsapi32

userenv

generic