2026-08-21_8e1f09bcbe19c4dcbf0873b30366798f_elex_phobos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_8e1f09bcbe19c4dcbf0873b30366798f_elex_phobos
Size 44KB
Sample260821-evdknasfla
SHA256 2d4e66ebd35ec253c1098a91d971ce836a150afa5716c45184a4e3ae285a44bf
MD5 8e1f09bcbe19c4dcbf0873b30366798f
SHA1 bba061a1aad428ca9064949925bf03a8166382c2
SHA512 80e70474606b03e8ff6b8af99065b517b3db062a7ecac75445f361b9aea69e9acc1445afb2e87c56fedad4a0003321013e1e1b119aaecc891f54d4536cf13a2d
SSDEEP 768:6vrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1Eb8W:ENeRBl5PT/rx1mzwRMSTdLpJb8W
TLSH
T1BA139E06746984B2CE7186B0293A6F5F4FBFA10540B484578F394E963ED5072E73E3BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_8e1f09bcbe19c4dcbf0873b30366798f_elex_phobos

File Explorer

2026-08-21_8e1f09bcbe19c4dcbf0873b30366798f_elex_phobos

.exe 44KB

2026-08-21_8e1f09bcbe19c4dcbf0873b30366798f_elex_phobos

IMPHASH 851a0ba8fbb71710075bdfe6dcef92eb
SHA256 2d4e66ebd35ec253c1098a91d971ce836a150afa5716c45184a4e3ae285a44bf
MD5 8e1f09bcbe19c4dcbf0873b30366798f
SHA1 bba061a1aad428ca9064949925bf03a8166382c2
SHA512 80e70474606b03e8ff6b8af99065b517b3db062a7ecac75445f361b9aea69e9acc1445afb2e87c56fedad4a0003321013e1e1b119aaecc891f54d4536cf13a2d
SSDEEP 768:6vrNNeRBl5JFTXqwXrkgrn/9/HiDKGwRj4RcTdyH4pYT3nPKVU1Eb8W:ENeRBl5PT/rx1mzwRMSTdLpJb8W
TLSH
T1BA139E06746984B2CE7186B0293A6F5F4FBFA10540B484578F394E963ED5072E73E3BA
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12199

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mpr

WNetEnumResourceW WNetUseConnectionW WNetOpenEnumW WNetCloseEnum

ws2_32

ioctlsocket getpeername ntohl select WSAGetLastError htons recv socket closesocket getsockopt WSAAddressToStringW htonl connect

iphlpapi

GetIpAddrTable

winhttp

WinHttpReceiveResponse WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSendRequest

kernel32

FindClose FindNextFileW SystemTimeToFileTime OpenProcess FindFirstFileW MoveFileW GetFileSizeEx SetFilePointerEx SetEndOfFile GetCurrentThreadId GetLocalTime ExitProcess SetFilePointer WaitForSingleObject GetComputerNameW SetEvent GetLogicalDrives GetTickCount Sleep CopyFileW GetFileAttributesW ReadFile CreateFileW MultiByteToWideChar CreateEventW WaitForMultipleObjects CloseHandle SetFileAttributesW CreateThread InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection ResetEvent DeleteCriticalSection AllocConsole WriteFile WideCharToMultiByte WriteConsoleW GetStdHandle CreateMutexW CreateProcessW GetCurrentProcess SetHandleInformation HeapFree GetLocaleInfoW ReadProcessMemory TerminateProcess GetModuleFileNameW FlushFileBuffers OpenMutexW GetLastError GetProcAddress Process32FirstW GetExitCodeThread CreatePipe Process32NextW GetModuleHandleA CreateToolhelp32Snapshot ReleaseMutex GetVersion DeleteFileW GetCurrentProcessId GetVolumeInformationW ExpandEnvironmentStringsW HeapAlloc GetProcessHeap HeapReAlloc QueryPerformanceCounter

user32

GetWindowThreadProcessId GetShellWindow

advapi32

FreeSid LookupPrivilegeValueW OpenProcessToken GetTokenInformation EqualSid RegSetValueExW RegCloseKey AdjustTokenPrivileges RegOpenKeyExW LookupAccountSidW AllocateAndInitializeSid DuplicateTokenEx RegQueryValueExW

shell32

ShellExecuteExW

ole32

CoGetObject CoInitializeEx CoUninitialize

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_8e1f09bcbe19c4dcbf0873b30366798f_elex_phobos

mpr

ws2_32

iphlpapi

winhttp

kernel32

user32

advapi32

shell32

ole32

generic