2026-08-12_18d0f258cfc0a4eb5d484b09bba05bea_elex_mafia_stealc_tofsee

General

Target
2026-08-12_18d0f258cfc0a4eb5d484b09bba05bea_elex_mafia_stealc_tofsee
Size 652KB
Sample260812-2pfjdsweld
SHA256 63ff1f2d6a1d689cde995f3a0a8b83ed8ad5c8e95fb7f08ddac9f4ca637d0cf4
MD5 18d0f258cfc0a4eb5d484b09bba05bea
SHA1 66cabf0a3c0f1583bfdc0f0779177a7fd2f11efe
SHA512 1ccb898417cb7dd57ec030ab5d16a2c4a9d0dbfd8e3ac3eb2c92efa978aa57bda26858acecbafc796b2a709ce45b308a4b5db75b71428af60ae8732facfcc23a
SSDEEP 12288:wU5rCOTeiDivGkImKTp067R5AIbx7PSukNNZ+3/v+I9hUG2VA:wUQOJDmGX/Lhx7qhNNGEA
TLSH
T130E4D12177D88536E5FB027859B5F6614E7EFD226722D6DF2F8011AE0AB1BC08631723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_18d0f258cfc0a4eb5d484b09bba05bea_elex_mafia_stealc_tofsee

File Explorer

2026-08-12_18d0f258cfc0a4eb5d484b09bba05bea_elex_mafia_stealc_tofsee

.exe 652KB

2026-08-12_18d0f258cfc0a4eb5d484b09bba05bea_elex_mafia_stealc_tofsee

IMPHASH 6dca3e9fb3928bbdb54dbce669943ec8
SHA256 63ff1f2d6a1d689cde995f3a0a8b83ed8ad5c8e95fb7f08ddac9f4ca637d0cf4
MD5 18d0f258cfc0a4eb5d484b09bba05bea
SHA1 66cabf0a3c0f1583bfdc0f0779177a7fd2f11efe
SHA512 1ccb898417cb7dd57ec030ab5d16a2c4a9d0dbfd8e3ac3eb2c92efa978aa57bda26858acecbafc796b2a709ce45b308a4b5db75b71428af60ae8732facfcc23a
SSDEEP 12288:wU5rCOTeiDivGkImKTp067R5AIbx7PSukNNZ+3/v+I9hUG2VA:wUQOJDmGX/Lhx7qhNNGEA
TLSH
T130E4D12177D88536E5FB027859B5F6614E7EFD226722D6DF2F8011AE0AB1BC08631723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

70582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetComputerNameW GetLocalTime SystemTimeToFileTime FileTimeToSystemTime SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar GetProcAddress LoadLibraryW GetCurrentProcess LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetLastError CloseHandle WideCharToMultiByte MoveFileW DeleteFileW CreateDirectoryW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW lstrlenW CreateFileW GetFileSize ReadFile WriteFile Sleep GetComputerNameA GetModuleFileNameW CreateProcessW GetSystemTime FileTimeToLocalFileTime RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalAlloc SetEndOfFile SetStdHandle WriteConsoleW FreeLibrary LoadLibraryA InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentThreadId RtlUnwind LCMapStringW GetCPInfo SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage SetFilePointer FlushFileBuffers GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW

ole32

CoCreateInstance CoInitialize

shlwapi

PathIsRootW PathFileExistsW PathAppendW PathAddExtensionW PathRemoveExtensionW

Name

.text

Size

137KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

262KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_18d0f258cfc0a4eb5d484b09bba05bea_elex_mafia_stealc_tofsee

kernel32

ole32

shlwapi

generic