2026-08-09_2d2d25d72831306ced43128a309551ae_elex_floxif_mafia_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_2d2d25d72831306ced43128a309551ae_elex_floxif_mafia_tofsee
Size 519KB
Sample260809-gejsvaaj7x
SHA256 aabda0fa3851a9ae1f249e2f6a3d23509e1fdae082106c0ad51a50ea4abc181b
MD5 2d2d25d72831306ced43128a309551ae
SHA1 4e11ceb536636b0778a68771d36fbde24def623f
SHA512 8a86e7dda7af7c796e5808abd36cab422f5f911a12617a74d7e42f7e92f611987dcaba013c80fdff2678c519f154ada78eb649956878cc5fcfa41e8d6b9c703b
SSDEEP 12288:TUXyRLu5aCWoevfZ1PUxHmA7RGbdOv4c54e08MGHxBjvrEH7f6:TFGeAxHmA7RGsvF54e08MGPrEH7S
TLSH
T171B48C207291C276E1E21270BE7DDB2A187DB869173501CBF3E40D6E2EB96D15B3172B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_2d2d25d72831306ced43128a309551ae_elex_floxif_mafia_tofsee

File Explorer

2026-08-09_2d2d25d72831306ced43128a309551ae_elex_floxif_mafia_tofsee

.exe 519KB

2026-08-09_2d2d25d72831306ced43128a309551ae_elex_floxif_mafia_tofsee

IMPHASH b8086f6290816fb617f882601f009ecd
SHA256 aabda0fa3851a9ae1f249e2f6a3d23509e1fdae082106c0ad51a50ea4abc181b
MD5 2d2d25d72831306ced43128a309551ae
SHA1 4e11ceb536636b0778a68771d36fbde24def623f
SHA512 8a86e7dda7af7c796e5808abd36cab422f5f911a12617a74d7e42f7e92f611987dcaba013c80fdff2678c519f154ada78eb649956878cc5fcfa41e8d6b9c703b
SSDEEP 12288:TUXyRLu5aCWoevfZ1PUxHmA7RGbdOv4c54e08MGHxBjvrEH7f6:TFGeAxHmA7RGsvF54e08MGPrEH7S
TLSH
T171B48C207291C276E1E21270BE7DDB2A187DB869173501CBF3E40D6E2EB96D15B3172B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

75:b5:f2:55:f9:6b:f6:a1:46:75:56:66:b5:88:dd:f1:00:6e:07:b8

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Helge Klein GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Helge Klein GmbH,L=Köln,ST=Nordrhein-Westfalen,C=DE

Chains

Sep 10, 2012

CN=Helge Klein GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Helge Klein GmbH,L=Köln,ST=Nordrhein-Westfalen,C=DE

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Helge Klein GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Helge Klein GmbH,L=Köln,ST=Nordrhein-Westfalen,C=DE

Serial Number

27:a9:04:54:92:bc:c8:64:10:a5:a3:0b:f5:34:1a:e8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 8, 2012 - Mar 8, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

224433

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Daten\Helge\Programmierung\SetACL3\Source\SetACL.exe\Win32\Release\SetACL.pdb

secur32

GetUserNameExW

version

VerQueryValueW

activeds

ord13

kernel32

FindClose CreateFileW InterlockedIncrement WideCharToMultiByte InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep GetCommandLineW HeapSetInformation RtlUnwind RaiseException GetCPInfo LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError FindFirstFileW IsProcessorFeaturePresent HeapCreate GetStdHandle GetLocaleInfoW ExitProcess FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc CompareStringW SetEnvironmentVariableW SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle WriteConsoleW SetEndOfFile ReadFile SetEvent ResetEvent ReleaseMutex CreateEventW CreateMutexW FindNextFileW MoveFileExW WriteFile SetFilePointerEx GetFileSizeEx GetCurrentThreadId GetLocalTime WaitForSingleObject CreateThread CompareFileTime LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FreeLibrary LocalFree FormatMessageW LoadLibraryExW InterlockedDecrement LoadLibraryW GetModuleFileNameW GetVersionExW GetComputerNameW FreeResource GetUserDefaultLangID LockResource LoadResource FindResourceW HeapFree GetProcessHeap HeapAlloc CloseHandle GetCurrentProcess GetProcAddress GetLastError GetModuleHandleW CreateDirectoryW GetFileAttributesW DeleteFileW

user32

LoadStringW

advapi32

LookupAccountNameW ConvertSidToStringSidW LookupAccountSidW MapGenericMask GetSecurityDescriptorLength AddAccessAllowedAce AddAce InitializeAcl IsValidAcl DeleteAce MakeSelfRelativeSD SetSecurityDescriptorSacl SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetNamedSecurityInfoW SetSecurityInfo IsValidSecurityDescriptor GetNamedSecurityInfoW GetKernelObjectSecurity ConvertStringSidToSidW EqualSid GetAce GetAclInformation ConvertSecurityDescriptorToStringSecurityDescriptorW GetSecurityDescriptorControl SetEntriesInAclW RegCreateKeyExW MakeAbsoluteSD ConvertStringSecurityDescriptorToSecurityDescriptorW ReportEventW DeregisterEventSource RegisterEventSourceW RegCloseKey RegOpenKeyExW RegConnectRegistryW RegEnumKeyExW CopySid GetLengthSid IsValidSid GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken

ole32

CoCreateInstance CoInitialize CoInitializeSecurity CoUninitialize CoSetProxyBlanket CoQueryProxyBlanket

oleaut32

SysAllocStringLen SafeArrayGetUBound SafeArrayGetLBound VariantClear VariantInit SysStringByteLen SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate SysAllocString SysFreeString SysAllocStringByteLen

netapi32

DsGetDcNameW NetShareSetInfo NetApiBufferFree NetDfsGetClientInfo NetShareGetInfo

mpr

WNetCloseEnum WNetEnumResourceW WNetOpenEnumW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_2d2d25d72831306ced43128a309551ae_elex_floxif_mafia_tofsee

PE Signature issue

secur32

version

activeds

kernel32

user32

advapi32

ole32

oleaut32

netapi32

mpr

generic