2026-08-06_e609fdffd2e05f2fdb57cd556c854702_elex_mafia_stealc_tofsee

General

Target
2026-08-06_e609fdffd2e05f2fdb57cd556c854702_elex_mafia_stealc_tofsee
Size 411KB
Sample260806-2d1eesvvht
SHA256 e9af618b40045452ff7416d7be6e5c32fdc2953a1c75f64daff5622b342810f7
MD5 e609fdffd2e05f2fdb57cd556c854702
SHA1 893f9032de9bebf36f26297b3b8b09a8482a6d76
SHA512 39519b559b97962c9de11c9e17e54a68d70946b2a2535730b8e6fc70918d79876add4c9f32d57f583a6fd65fe6c568f6188fdc60b33f0725ac75f50cf507bb65
SSDEEP 12288:gZLolhNVyExJ6e9uI67pYgjPeREZTOkUQqHI:gZqhOExsVI69e4TOkUC
TLSH
T11A94DF2976C1C032E19701318BB6DB75193A7DB15B61A4CBB3983B7E1E703D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_e609fdffd2e05f2fdb57cd556c854702_elex_mafia_stealc_tofsee

File Explorer

2026-08-06_e609fdffd2e05f2fdb57cd556c854702_elex_mafia_stealc_tofsee

.exe 411KB

2026-08-06_e609fdffd2e05f2fdb57cd556c854702_elex_mafia_stealc_tofsee

IMPHASH 6dca3e9fb3928bbdb54dbce669943ec8
SHA256 e9af618b40045452ff7416d7be6e5c32fdc2953a1c75f64daff5622b342810f7
MD5 e609fdffd2e05f2fdb57cd556c854702
SHA1 893f9032de9bebf36f26297b3b8b09a8482a6d76
SHA512 39519b559b97962c9de11c9e17e54a68d70946b2a2535730b8e6fc70918d79876add4c9f32d57f583a6fd65fe6c568f6188fdc60b33f0725ac75f50cf507bb65
SSDEEP 12288:gZLolhNVyExJ6e9uI67pYgjPeREZTOkUQqHI:gZqhOExsVI69e4TOkUC
TLSH
T11A94DF2976C1C032E19701318BB6DB75193A7DB15B61A4CBB3983B7E1E703D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

70614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetComputerNameW GetLocalTime SystemTimeToFileTime FileTimeToSystemTime SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar GetProcAddress LoadLibraryW GetCurrentProcess LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetLastError CloseHandle WideCharToMultiByte MoveFileW DeleteFileW CreateDirectoryW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW lstrlenW CreateFileW GetFileSize ReadFile WriteFile Sleep GetComputerNameA GetModuleFileNameW CreateProcessW GetSystemTime FileTimeToLocalFileTime RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalAlloc SetEndOfFile SetStdHandle WriteConsoleW FreeLibrary LoadLibraryA InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentThreadId RtlUnwind LCMapStringW GetCPInfo SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage SetFilePointer FlushFileBuffers GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW

ole32

CoCreateInstance CoInitialize

shlwapi

PathIsRootW PathFileExistsW PathAppendW PathAddExtensionW PathRemoveExtensionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_e609fdffd2e05f2fdb57cd556c854702_elex_mafia_stealc_tofsee

kernel32

ole32

shlwapi

generic