2026-08-04_fe87bc5bb8b3ea31ca86fd79122ac819_elex_mafia_stealc_tofsee

General

Target
2026-08-04_fe87bc5bb8b3ea31ca86fd79122ac819_elex_mafia_stealc_tofsee
Size 411KB
Sample260804-vxbrvaec46
SHA256 08bcd1dc94ef0fcbaf4f7b7e3783a41704ce9b3f6ff277e907cca72df1d537b3
MD5 fe87bc5bb8b3ea31ca86fd79122ac819
SHA1 44747254aa17e91780e0aaa2aa369aaf1fe44be3
SHA512 7fec94b5cca15b1c585c27032b255339eb77147e17a3d7730fca29e36af08a3121ef112ed8a0e5f5422710e2adca5cb7af3df91a8419af322dfb43e64663fa3a
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFkFKwfCRqGirvEVSZv5ij/rglcbiBUndqHI:gZLolhNVyEX4tqGB4ZIjzg4iBUndqHI
TLSH
T10194DF25B2C1C036D59300314AB6DB76193A7DB25B61A4CBB3D83B6D1FB13D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_fe87bc5bb8b3ea31ca86fd79122ac819_elex_mafia_stealc_tofsee

File Explorer

2026-08-04_fe87bc5bb8b3ea31ca86fd79122ac819_elex_mafia_stealc_tofsee

.exe 411KB

2026-08-04_fe87bc5bb8b3ea31ca86fd79122ac819_elex_mafia_stealc_tofsee

IMPHASH 6dca3e9fb3928bbdb54dbce669943ec8
SHA256 08bcd1dc94ef0fcbaf4f7b7e3783a41704ce9b3f6ff277e907cca72df1d537b3
MD5 fe87bc5bb8b3ea31ca86fd79122ac819
SHA1 44747254aa17e91780e0aaa2aa369aaf1fe44be3
SHA512 7fec94b5cca15b1c585c27032b255339eb77147e17a3d7730fca29e36af08a3121ef112ed8a0e5f5422710e2adca5cb7af3df91a8419af322dfb43e64663fa3a
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFkFKwfCRqGirvEVSZv5ij/rglcbiBUndqHI:gZLolhNVyEX4tqGB4ZIjzg4iBUndqHI
TLSH
T10194DF25B2C1C036D59300314AB6DB76193A7DB25B61A4CBB3D83B6D1FB13D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

70614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetComputerNameW GetLocalTime SystemTimeToFileTime FileTimeToSystemTime SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar GetProcAddress LoadLibraryW GetCurrentProcess LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetLastError CloseHandle WideCharToMultiByte MoveFileW DeleteFileW CreateDirectoryW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW lstrlenW CreateFileW GetFileSize ReadFile WriteFile Sleep GetComputerNameA GetModuleFileNameW CreateProcessW GetSystemTime FileTimeToLocalFileTime RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalAlloc SetEndOfFile SetStdHandle WriteConsoleW FreeLibrary LoadLibraryA InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentThreadId RtlUnwind LCMapStringW GetCPInfo SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage SetFilePointer FlushFileBuffers GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW

ole32

CoCreateInstance CoInitialize

shlwapi

PathIsRootW PathFileExistsW PathAppendW PathAddExtensionW PathRemoveExtensionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_fe87bc5bb8b3ea31ca86fd79122ac819_elex_mafia_stealc_tofsee

kernel32

ole32

shlwapi

generic