2026-07-31_39dd5ae18a6403d968d38b95e244f00a_elex_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_39dd5ae18a6403d968d38b95e244f00a_elex_stealc_stop_tofsee
Size 519KB
Sample260731-n94vtsfn21
SHA256 06000dc579932f7d58aa1f94a1352cf8971ec19a24f9aeceabb4bfcfb9763968
MD5 39dd5ae18a6403d968d38b95e244f00a
SHA1 ffbfdf7ca208d08979f8ccb3c0f3223451ed9e86
SHA512 3e12511690aa6b9936794a3e4bb86581af2aedf15d1d8d5d28bc45036b780e8ad008f4ee72307f8112bdc6d7c86d49e89a04326513a220a31d7b6f37ab3c9852
SSDEEP 3072:Kql7oLfyiRA3DcPnZmM2lO+QQjdSObyCw5sloGFE:R7oQj39bbFqGK
TLSH
T1F6B45B24B681C433E8A30871A8ACC7BE691CBA711B5550C7F7C85FAD1BB52E35B3125B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_39dd5ae18a6403d968d38b95e244f00a_elex_stealc_stop_tofsee

File Explorer

2026-07-31_39dd5ae18a6403d968d38b95e244f00a_elex_stealc_stop_tofsee

.exe 519KB

2026-07-31_39dd5ae18a6403d968d38b95e244f00a_elex_stealc_stop_tofsee

IMPHASH a57d746bb902afefabe9b30f4953166b
SHA256 06000dc579932f7d58aa1f94a1352cf8971ec19a24f9aeceabb4bfcfb9763968
MD5 39dd5ae18a6403d968d38b95e244f00a
SHA1 ffbfdf7ca208d08979f8ccb3c0f3223451ed9e86
SHA512 3e12511690aa6b9936794a3e4bb86581af2aedf15d1d8d5d28bc45036b780e8ad008f4ee72307f8112bdc6d7c86d49e89a04326513a220a31d7b6f37ab3c9852
SSDEEP 3072:Kql7oLfyiRA3DcPnZmM2lO+QQjdSObyCw5sloGFE:R7oQj39bbFqGK
TLSH
T1F6B45B24B681C433E8A30871A8ACC7BE691CBA711B5550C7F7C85FAD1BB52E35B3125B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80426

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar InterlockedDecrement MoveFileExA SetFileAttributesA DeleteFileA GetLastError FindFirstFileA lstrcmpA FindNextFileA FindClose RemoveDirectoryA GetFileAttributesA GetModuleHandleA GetProcAddress CloseHandle Sleep GetSystemDirectoryA GetCommandLineA OutputDebugStringA InitializeCriticalSectionAndSpinCount LoadLibraryA GetLocaleInfoA lstrlenA WideCharToMultiByte HeapFree GetProcessHeap RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoA HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

wsprintfA MessageBoxA

advapi32

DeleteService RegDeleteKeyA RegDeleteValueA RegFlushKey RegEnumKeyExA StartServiceA OpenSCManagerA OpenServiceA CloseServiceHandle QueryServiceStatus ControlService RegOpenKeyExA RegQueryValueExA RegCloseKey RegEnumValueA EnumDependentServicesA

ole32

CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

VariantInit VariantClear VariantChangeType SysStringLen SysFreeString SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_39dd5ae18a6403d968d38b95e244f00a_elex_stealc_stop_tofsee

kernel32

user32

advapi32

ole32

oleaut32

generic