2026-07-30_5613b6cf5c91808ba541cad9f3d3c47e_elex_maze_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_5613b6cf5c91808ba541cad9f3d3c47e_elex_maze_stealc
Size 1.6MB
Sample260730-kveevaysct
SHA256 73ea10eb7aa997daab91fb3a945bf8fd2c589a6d6ed159e567ca1df4c354caec
MD5 5613b6cf5c91808ba541cad9f3d3c47e
SHA1 f5eaf37e449a6b5f5b542ddccf065c02c5f143df
SHA512 e654b5a2b22d6dba8190388e2e679c69204067bf3deb764c0c4d899a85b87ea0fec8044d2030b79562d77dad9eca2494af89130ab56312b4286b1d9ee5860a7c
SSDEEP 24576:sRSpQIq+CbFv+dnQ/tbw/2Mkjy6Fr7g0oO:Fq+ev+dQ/lFTjN4
TLSH
T12B75E0207A82C031E9A202F16E7DDB67543EB9701B755ACBF7C80F5E1A306D16B36B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_5613b6cf5c91808ba541cad9f3d3c47e_elex_maze_stealc

File Explorer

2026-07-30_5613b6cf5c91808ba541cad9f3d3c47e_elex_maze_stealc

.exe 1.6MB

2026-07-30_5613b6cf5c91808ba541cad9f3d3c47e_elex_maze_stealc

IMPHASH 3bd440d0afb0f13184f73e29b680835f
SHA256 73ea10eb7aa997daab91fb3a945bf8fd2c589a6d6ed159e567ca1df4c354caec
MD5 5613b6cf5c91808ba541cad9f3d3c47e
SHA1 f5eaf37e449a6b5f5b542ddccf065c02c5f143df
SHA512 e654b5a2b22d6dba8190388e2e679c69204067bf3deb764c0c4d899a85b87ea0fec8044d2030b79562d77dad9eca2494af89130ab56312b4286b1d9ee5860a7c
SSDEEP 24576:sRSpQIq+CbFv+dnQ/tbw/2Mkjy6Fr7g0oO:Fq+ev+dQ/lFTjN4
TLSH
T12B75E0207A82C031E9A202F16E7DDB67543EB9701B755ACBF7C80F5E1A306D16B36B16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

186696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\build\workspace\miflash_git\out\Release\bin\recovery.pdb

shlwapi

SHCreateStreamOnFileEx

kernel32

GetUserDefaultLangID Process32FirstW Process32NextW CreateToolhelp32Snapshot SetEvent ResetEvent WaitForMultipleObjects GetCurrentProcess CreateDirectoryW GetFileAttributesW ReadFile GetTempPathW GetCurrentDirectoryW SetLastError GetFileAttributesExW DeleteFileW WideCharToMultiByte MultiByteToWideChar InterlockedCompareExchange SystemTimeToTzSpecificLocalTime QueryPerformanceCounter GetSystemTimeAsFileTime FileTimeToSystemTime SetEndOfFile SetFilePointerEx FlushFileBuffers CreateMutexW SetFilePointer CreateProcessW WaitForSingleObject FormatMessageA GetModuleFileNameW GetModuleHandleA ReleaseMutex GetCurrentProcessId GetNativeSystemInfo GetModuleHandleW GetVersionExW GetProcAddress GetCurrentThreadId InterlockedExchangeAdd LeaveCriticalSection EnterCriticalSection DeleteCriticalSection Sleep RaiseException IsDebuggerPresent CreateThread CreateEventW GetModuleHandleExW TlsGetValue TlsSetValue TlsAlloc TlsFree CloseHandle GetDriveTypeW GetSystemDirectoryW OutputDebugStringW GetLocalTime GetEnvironmentStringsW FreeEnvironmentStringsW DecodePointer SetUnhandledExceptionFilter GetComputerNameW EncodePointer GetStringTypeW IsProcessorFeaturePresent HeapFree HeapAlloc ExitProcess AreFileApisANSI HeapReAlloc GetCommandLineA GetFullPathNameW SetStdHandle GetFileType GetProcessHeap GetConsoleCP GetConsoleMode LoadLibraryExW ReadConsoleW RtlUnwind GetCPInfo UnhandledExceptionFilter TerminateProcess GetStartupInfoW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle HeapSize IsValidCodePage GetACP GetOEMCP GetModuleFileNameA GetTimeZoneInformation WriteConsoleW SetEnvironmentVariableA CreateFileW WriteFile CreateFileMappingW UnmapViewOfFile MapViewOfFile GetTickCount SetConsoleCtrlHandler GetLastError GetWindowsDirectoryW InitializeCriticalSectionAndSpinCount

ole32

CoTaskMemFree CoCreateInstance CoUninitialize CoInitializeEx

dbghelp

MiniDumpWriteDump

winmm

timeGetTime

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW CM_Get_DevNode_Status_Ex CM_Disconnect_Machine CM_Get_Child_Ex CM_Connect_MachineW CM_Get_Sibling_Ex CM_Get_Device_ID_ExW CM_Locate_DevNode_ExW CM_Get_DevNode_Registry_PropertyW

user32

MessageBoxW GetActiveWindow

advapi32

IsTextUnicode

shell32

SHGetFolderPathW SHFileOperationW

adbwinapi

AdbGetUsbDeviceDescriptor AdbNextInterface AdbEnumInterfaces AdbGetSerialNumber AdbOpenEndpoint AdbOpenDefaultBulkReadEndpoint AdbReadEndpointSync AdbCreateInterfaceByName AdbOpenDefaultBulkWriteEndpoint AdbWriteEndpointSync AdbGetEndpointInformation AdbCloseHandle AdbGetUsbInterfaceDescriptor

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

311KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_5613b6cf5c91808ba541cad9f3d3c47e_elex_maze_stealc

shlwapi

kernel32

ole32

dbghelp

winmm

setupapi

user32

advapi32

shell32

adbwinapi

version

generic