2026-09-29_1fad3577d4b54fd265023775ad289ba2_elex_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_1fad3577d4b54fd265023775ad289ba2_elex_stealc_stop
Size 4.3MB
Sample260930-292x5acd72
SHA256 6b4d9dc4cf57b465417946d2f0ab9fff4e67910141c5a6a3c72c1d5ab765a0a9
MD5 1fad3577d4b54fd265023775ad289ba2
SHA1 71589794e9942e072a92267a645acaae37b47c94
SHA512 6e68f5230b0d819d8bdfb2b25ebc9a83e4b3eab17ae3683f8b5c7601e46b58176e2a8f9e31a00775f8eea8f2d49afcd3a248937430e3e25170c2d2b72528ef0d
SSDEEP 98304:ddW1yAZj7eKAITc54gnM2D2ngk0kizb4S4atjBta+uSbd0+JGqB:uk67tAmkM2Dnk01z4atqhqB
TLSH
T109260151E3F95060E2B32A745C7456DF4922BF239B7492DB527C3D198F3EA989832323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-29_1fad3577d4b54fd265023775ad289ba2_elex_stealc_stop

.exe 4.3MB

2026-09-29_1fad3577d4b54fd265023775ad289ba2_elex_stealc_stop

IMPHASH b48671fed9d5ca4906417d42fcdb066b
SHA256 6b4d9dc4cf57b465417946d2f0ab9fff4e67910141c5a6a3c72c1d5ab765a0a9
MD5 1fad3577d4b54fd265023775ad289ba2
SHA1 71589794e9942e072a92267a645acaae37b47c94
SHA512 6e68f5230b0d819d8bdfb2b25ebc9a83e4b3eab17ae3683f8b5c7601e46b58176e2a8f9e31a00775f8eea8f2d49afcd3a248937430e3e25170c2d2b72528ef0d
SSDEEP 98304:ddW1yAZj7eKAITc54gnM2D2ngk0kizb4S4atjBta+uSbd0+JGqB:uk67tAmkM2Dnk01z4atqhqB
TLSH
T109260151E3F95060E2B32A745C7456DF4922BF239B7492DB527C3D198F3EA989832323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

af:aa:31:ca:a7:54:17:77:5c:56:c6:6f:c5:88:49:5d:80:dc:25:d2:6d:00:a9:46:af:01:98:26:84:59:72:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=68 643 065 114,CN=Winthrop Development Consultants Pty Ltd,O=Winthrop Development Consultants Pty Ltd,POSTALCODE=6150,STREET=52 Sutherland Crescent,L=Winthrop,ST=Western Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Chains

May 2, 2023

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

52:e8:ee:93:2e:af:18:ea:bb:29:b0:74:be:f6:14:5f:07:70:2a:1f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

May 2, 2023

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 3, 2014 - Dec 2, 2029

Subject

Serial Number

6d:f9:06:4b:3a:79:19:63:9f:66:8d:49:07:29:39:7d

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 31, 2020 - Jul 31, 2023

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Minor OS version

Major OS version

Entry point

142424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError ResetEvent CreateEventW CloseHandle MultiByteToWideChar WideCharToMultiByte FreeLibrary LoadLibraryW GetModuleFileNameW FormatMessageW LocalFree GetWindowsDirectoryW CreateFileW SetFileTime SetFileAttributesW RemoveDirectoryW CreateDirectoryW GetFileInformationByHandle DeleteFileW GetShortPathNameW GetFullPathNameW lstrlenW GetCurrentDirectoryW GetTempFileNameW FindClose FindFirstFileW FindNextFileW GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile DeleteCriticalSection GetStdHandle EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects GetCurrentProcessId InitializeCriticalSection QueryPerformanceCounter GetTickCount Sleep LocalAlloc GetProcAddress SetCurrentDirectoryW GetSystemDefaultUILanguage GetUserDefaultUILanguage SetThreadUILanguage SetThreadLocale GetVersion GetCommandLineW CreateProcessW GetExitCodeProcess FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetConsoleMode GetConsoleCP GetLocaleInfoA IsValidCodePage GetOEMCP RaiseException GetACP GetCPInfo LoadLibraryA RtlUnwind InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime WaitForSingleObject SetEvent GetVersionExW VirtualAlloc GetCurrentThreadId VirtualFree GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapSize InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc HeapFree HeapAlloc ExitThread CreateThread HeapReAlloc GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate GetModuleHandleW ExitProcess GetModuleFileNameA TlsGetValue

user32

SetForegroundWindow CharUpperW GetWindowRect DestroyWindow RegisterWindowMessageW AdjustWindowRect LoadImageW LoadIconW KillTimer SetTimer EndDialog IsDlgButtonChecked SetDlgItemTextW GetDlgItem SetWindowTextW GetWindowTextW GetWindowTextLengthW LoadStringW DialogBoxParamW CreateDialogParamW SystemParametersInfoW PeekMessageW GetDesktopWindow MessageBoxW SendMessageW GetWindowLongW SetWindowLongW ShowWindow MoveWindow PostMessageW

gdi32

GetObjectW

advapi32

RegSetValueExW RegCreateKeyExW RegCloseKey

shell32

SHGetFolderPathW ShellExecuteExW

ole32

CoInitializeEx CoInitialize CoCreateInstance

oleaut32

SysAllocStringLen SysFreeString VariantClear SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_1fad3577d4b54fd265023775ad289ba2_elex_stealc_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic