2026-08-02_8b6fe758a76b34258b8931b8ac7147e4_elex_mafia_stealc_tofsee

General

Target
2026-08-02_8b6fe758a76b34258b8931b8ac7147e4_elex_mafia_stealc_tofsee
Size 411KB
Sample260802-ddyc3a11es
SHA256 b80029afb46e1b37d652959fda8429fd6bb66b54a2bef8ce8e177e0c85c66186
MD5 8b6fe758a76b34258b8931b8ac7147e4
SHA1 9958f607b413b69f24521cee55c7217b06a5ee89
SHA512 399365c859c91cbe3b3e5144a969214eec45b0d5b0756c7e416e05b5dd3a56fde4b782ae613f71c228550a86175331945bc240af952318520e392b1a93f37db3
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFRDUOH7DXC9vDAjrlwiZb9Z7MqHI:gZLolhNVyEGUOb7FlwCsqHI
TLSH
T1D294CF28B2C1C036D19301314AE6D776693A7DB14B6264DBB3D83B7D1FB02D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_8b6fe758a76b34258b8931b8ac7147e4_elex_mafia_stealc_tofsee

File Explorer

2026-08-02_8b6fe758a76b34258b8931b8ac7147e4_elex_mafia_stealc_tofsee

.exe 411KB

2026-08-02_8b6fe758a76b34258b8931b8ac7147e4_elex_mafia_stealc_tofsee

IMPHASH 6dca3e9fb3928bbdb54dbce669943ec8
SHA256 b80029afb46e1b37d652959fda8429fd6bb66b54a2bef8ce8e177e0c85c66186
MD5 8b6fe758a76b34258b8931b8ac7147e4
SHA1 9958f607b413b69f24521cee55c7217b06a5ee89
SHA512 399365c859c91cbe3b3e5144a969214eec45b0d5b0756c7e416e05b5dd3a56fde4b782ae613f71c228550a86175331945bc240af952318520e392b1a93f37db3
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFRDUOH7DXC9vDAjrlwiZb9Z7MqHI:gZLolhNVyEGUOb7FlwCsqHI
TLSH
T1D294CF28B2C1C036D19301314AE6D776693A7DB14B6264DBB3D83B7D1FB02D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

70614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetComputerNameW GetLocalTime SystemTimeToFileTime FileTimeToSystemTime SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar GetProcAddress LoadLibraryW GetCurrentProcess LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetLastError CloseHandle WideCharToMultiByte MoveFileW DeleteFileW CreateDirectoryW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW lstrlenW CreateFileW GetFileSize ReadFile WriteFile Sleep GetComputerNameA GetModuleFileNameW CreateProcessW GetSystemTime FileTimeToLocalFileTime RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalAlloc SetEndOfFile SetStdHandle WriteConsoleW FreeLibrary LoadLibraryA InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentThreadId RtlUnwind LCMapStringW GetCPInfo SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage SetFilePointer FlushFileBuffers GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW

ole32

CoCreateInstance CoInitialize

shlwapi

PathIsRootW PathFileExistsW PathAppendW PathAddExtensionW PathRemoveExtensionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_8b6fe758a76b34258b8931b8ac7147e4_elex_mafia_stealc_tofsee

kernel32

ole32

shlwapi

generic