2026-09-22_94df0488e2a355bf9fc0869cba3aa993_elex_maze_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-22_94df0488e2a355bf9fc0869cba3aa993_elex_maze_stealc
Size 4.6MB
Sample260922-xda3bada59
SHA256 670f0164dfe27a2046050b35681a2725540760dc215c93d9d94f63f70fb36389
MD5 94df0488e2a355bf9fc0869cba3aa993
SHA1 984d2bed1c2e19b1786e6ba6fd1663839c46529b
SHA512 4d951e09703fed6013d996e3a81529dacc8d867d8469c37949cb97470844e260e6d9d70182b9b860813b8db29b068935f7cda589a0ff0c195ce7ea29b7529869
SSDEEP 49152:hAzICE0DwJXCDMmBQTN6An3tQa+NNagbp5NL5XLvRtkGGb/:CDwUMmBINZ39+NNagT7/V
TLSH
T1AC265C40FB87D5B1CA87423910ADB72E466DEF5087269AE7D20C3B2E9A717C12F324D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-22_94df0488e2a355bf9fc0869cba3aa993_elex_maze_stealc

File Explorer

2026-09-22_94df0488e2a355bf9fc0869cba3aa993_elex_maze_stealc

.exe 4.6MB

2026-09-22_94df0488e2a355bf9fc0869cba3aa993_elex_maze_stealc

IMPHASH 5e1d82a58d8afa93a9bf2554008e9979
SHA256 670f0164dfe27a2046050b35681a2725540760dc215c93d9d94f63f70fb36389
MD5 94df0488e2a355bf9fc0869cba3aa993
SHA1 984d2bed1c2e19b1786e6ba6fd1663839c46529b
SHA512 4d951e09703fed6013d996e3a81529dacc8d867d8469c37949cb97470844e260e6d9d70182b9b860813b8db29b068935f7cda589a0ff0c195ce7ea29b7529869
SSDEEP 49152:hAzICE0DwJXCDMmBQTN6An3tQa+NNagbp5NL5XLvRtkGGb/:CDwUMmBINZ39+NNagT7/V
TLSH
T1AC265C40FB87D5B1CA87423910ADB72E466DEF5087269AE7D20C3B2E9A717C12F324D5
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2437868

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Home\noboru\SRC\qaac\build-vc12-x86\qaac.pdb

shlwapi

PathFindFileNameW PathCombineW PathFindExtensionW

advapi32

RegOpenKeyExW ReportEventW RegisterEventSourceW DeregisterEventSource RegCloseKey RegQueryValueExW

ole32

CoCreateInstance PropVariantClear CoInitialize CoUninitialize CreateStreamOnHGlobal CoInitializeEx CoTaskMemFree OleRun

kernel32

InterlockedPushEntrySList InterlockedFlushSList GetSystemTimeAsFileTime InterlockedPopEntrySList InitializeSListHead ReleaseSemaphore lstrlenW WaitForMultipleObjectsEx GetTimeZoneInformation FlushFileBuffers GetFileAttributesExW ReadConsoleW FreeEnvironmentStringsW GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW GetFileType GetFullPathNameW OutputDebugStringA OutputDebugStringW GetLastError SetErrorMode GetCurrentProcess SetPriorityClass UnmapViewOfFile FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW SetDllDirectoryW GetConsoleTitleW SetConsoleTitleW GetConsoleMode SetConsoleCtrlHandler WriteConsoleW GetConsoleWindow WideCharToMultiByte MultiByteToWideChar CreateFileW GetFileInformationByHandle GetFileSize CloseHandle ConnectNamedPipe CreateNamedPipeW GetCurrentProcessId CreateFileMappingW MapViewOfFile FindResourceExW FreeResource LoadResource LockResource SizeofResource LocalFree FormatMessageW GetStdHandle SetEvent ResetEvent CreateEventW WaitForMultipleObjects ReadConsoleInputW WriteFile CreatePipe SetHandleInformation WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileSizeEx ReadFile SetEndOfFile SetFilePointerEx GetTempPathW RaiseException LoadLibraryExA QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitOnceBeginInitialize InitOnceComplete InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS CreateThread SetThreadPriority GetSystemInfo MapViewOfFileEx GetEnvironmentStringsW FindNextFileW FindFirstFileExW FindClose UnregisterWaitEx SetProcessAffinityMask VirtualProtect VirtualFree DuplicateHandle GetCurrentThread GetCurrentThreadId GetExitCodeThread EncodePointer DecodePointer GetStringTypeW RtlUnwind HeapFree HeapAlloc HeapReAlloc GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW SetStdHandle FileTimeToLocalFileTime PeekNamedPipe FileTimeToSystemTime IsProcessorFeaturePresent GetCPInfo GetModuleHandleW GetConsoleCP DeleteFileW FatalAppExitA UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetTickCount CreateSemaphoreW ExitThread TryEnterCriticalSection CreateTimerQueue RtlCaptureStackBackTrace WaitForSingleObjectEx SignalObjectAndWait SwitchToThread GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW AreFileApisANSI HeapSize IsDebuggerPresent GetProcessHeap IsValidCodePage GetACP GetOEMCP SetEnvironmentVariableA GetVersionExW VirtualAlloc QueryDepthSList

user32

IsWindowVisible

shell32

SHGetFolderPathW SHCreateDirectoryExW

oleaut32

VariantInit GetErrorInfo VariantClear VariantChangeType SetErrorInfo SysFreeString CreateErrorInfo

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

882KB

Virtual Size

882KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

70KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_94df0488e2a355bf9fc0869cba3aa993_elex_maze_stealc

shlwapi

advapi32

ole32

kernel32

user32

shell32

oleaut32

generic