2026-08-04_399894b199aab3a34ad4e4d15016823b_elex_mafia_stealc_tofsee

General

Target
2026-08-04_399894b199aab3a34ad4e4d15016823b_elex_mafia_stealc_tofsee
Size 428KB
Sample260804-zdpa2sgf39
SHA256 c2a3526ab94503c1430fbf61eb9b2b09ccbf470add57a7d97ee4ee44c28b13a4
MD5 399894b199aab3a34ad4e4d15016823b
SHA1 8b686e30e75c843982914dac1e1e3eb7bae0422e
SHA512 2aa4240dde02797f5abc63a4a13b8f0f8153d55848aaa057ade2ac7463d4da269bed25dc8794f533a2f4c0cfc72d0c1d29ad1e2d7aa1f029f78aa3b63645fea1
SSDEEP 12288:gZLolhNVyEbZdd7Sv6Z9zRy+mbt/C8EqHR:gZqhOEFdIvgRgbD
TLSH
T11694CF25B2C1C036E19301314AEAD7B5153A7DA15F6260DBB3D8377E2EB43D0AA7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_399894b199aab3a34ad4e4d15016823b_elex_mafia_stealc_tofsee

File Explorer

2026-08-04_399894b199aab3a34ad4e4d15016823b_elex_mafia_stealc_tofsee

.exe 428KB

2026-08-04_399894b199aab3a34ad4e4d15016823b_elex_mafia_stealc_tofsee

IMPHASH 6dca3e9fb3928bbdb54dbce669943ec8
SHA256 c2a3526ab94503c1430fbf61eb9b2b09ccbf470add57a7d97ee4ee44c28b13a4
MD5 399894b199aab3a34ad4e4d15016823b
SHA1 8b686e30e75c843982914dac1e1e3eb7bae0422e
SHA512 2aa4240dde02797f5abc63a4a13b8f0f8153d55848aaa057ade2ac7463d4da269bed25dc8794f533a2f4c0cfc72d0c1d29ad1e2d7aa1f029f78aa3b63645fea1
SSDEEP 12288:gZLolhNVyEbZdd7Sv6Z9zRy+mbt/C8EqHR:gZqhOEFdIvgRgbD
TLSH
T11694CF25B2C1C036E19301314AEAD7B5153A7DA15F6260DBB3D8377E2EB43D0AA7931B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

70614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetComputerNameW GetLocalTime SystemTimeToFileTime FileTimeToSystemTime SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar GetProcAddress LoadLibraryW GetCurrentProcess LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetLastError CloseHandle WideCharToMultiByte MoveFileW DeleteFileW CreateDirectoryW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW lstrlenW CreateFileW GetFileSize ReadFile WriteFile Sleep GetComputerNameA GetModuleFileNameW CreateProcessW GetSystemTime FileTimeToLocalFileTime RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalAlloc SetEndOfFile SetStdHandle WriteConsoleW FreeLibrary LoadLibraryA InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentThreadId RtlUnwind LCMapStringW GetCPInfo SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage SetFilePointer FlushFileBuffers GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW

ole32

CoCreateInstance CoInitialize

shlwapi

PathIsRootW PathFileExistsW PathAppendW PathAddExtensionW PathRemoveExtensionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_399894b199aab3a34ad4e4d15016823b_elex_mafia_stealc_tofsee

kernel32

ole32

shlwapi

generic