2026-10-02_2fd6909dd9c7d518c436da2f3eefbda8_elex_mafia_stealc_x-agent

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_2fd6909dd9c7d518c436da2f3eefbda8_elex_mafia_stealc_x-agent
Size 209KB
Sample261003-shtm1a1eka
SHA256 850bb427239a41b00414f4b2b176a84e6a48977887da1dcc31f3b0eb8c8ebf93
MD5 2fd6909dd9c7d518c436da2f3eefbda8
SHA1 3c84c16116a3c4014d8984e6ce86b5c28200f24d
SHA512 fb6c445e168ad9608acf9bda760d05516a5a006e7f6441439dba9b9484aa2922ce4752aee910e1c83b3a354156ff33d0ff04b763153fe70a24a3c998267e07fa
SSDEEP 6144:95xm87jlt74jyRQ5TG+NyElx8SQ6TO9NG4oY:hpk35TG+NyEn8SaNaY
TLSH
T165248D307A948033E5A711358AFC9BBE696AB8320B2511CBF7D90F7D5E606D34A3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_2fd6909dd9c7d518c436da2f3eefbda8_elex_mafia_stealc_x-agent

File Explorer

2026-10-02_2fd6909dd9c7d518c436da2f3eefbda8_elex_mafia_stealc_x-agent

.exe 209KB

2026-10-02_2fd6909dd9c7d518c436da2f3eefbda8_elex_mafia_stealc_x-agent

IMPHASH 7115f76cb07e1810c695e83183f30adc
SHA256 850bb427239a41b00414f4b2b176a84e6a48977887da1dcc31f3b0eb8c8ebf93
MD5 2fd6909dd9c7d518c436da2f3eefbda8
SHA1 3c84c16116a3c4014d8984e6ce86b5c28200f24d
SHA512 fb6c445e168ad9608acf9bda760d05516a5a006e7f6441439dba9b9484aa2922ce4752aee910e1c83b3a354156ff33d0ff04b763153fe70a24a3c998267e07fa
SSDEEP 6144:95xm87jlt74jyRQ5TG+NyElx8SQ6TO9NG4oY:hpk35TG+NyEn8SaNaY
TLSH
T165248D307A948033E5A711358AFC9BBE696AB8320B2511CBF7D90F7D5E606D34A3534B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

83741

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteFileW GetProcAddress GetModuleHandleW SetFilePointer GetLocalTime GetVolumeInformationW CreateMutexW CreateProcessW GetEnvironmentVariableW SetStdHandle GetConsoleMode GetConsoleCP IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID HeapSize HeapReAlloc GetStringTypeW IsValidCodePage GetOEMCP GetACP GetSystemTimeAsFileTime GetFileSize VirtualAlloc VirtualFree CreateFileW WideCharToMultiByte GetCurrentThreadId WriteFile OpenProcess GetLastError GetTickCount CreateMailslotW GetMailslotInfo ReadFile WaitForSingleObject GetExitCodeThread CreateThread TerminateThread CloseHandle WriteConsoleW Sleep GetCurrentProcessId QueryPerformanceCounter GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetModuleFileNameA ExitProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedIncrement InterlockedDecrement InterlockedExchange MultiByteToWideChar InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer HeapFree RtlUnwind RaiseException HeapAlloc FreeLibrary LoadLibraryW GetCommandLineA HeapSetInformation GetStartupInfoW LCMapStringW GetCPInfo IsProcessorFeaturePresent GetStdHandle GetModuleFileNameW GetLocaleInfoW HeapCreate

user32

GetWindowRect GetDC SendMessageTimeoutW WindowFromPoint EnumDisplayMonitors ReleaseDC GetForegroundWindow GetWindowDC GetCursorPos ToUnicodeEx MapVirtualKeyExW GetKeyboardLayout GetKeyboardState wsprintfW GetWindowThreadProcessId AttachThreadInput

gdi32

GetDeviceCaps CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteObject

advapi32

RegSetValueExW RegCreateKeyExW RegEnumKeyExW GetUserNameW RegOpenKeyExW RegQueryValueExW RegCloseKey

ole32

CreateStreamOnHGlobal StringFromCLSID

shlwapi

SHDeleteKeyW PathFileExistsW PathFindFileNameW

gdiplus

GdiplusStartup GdipCloneImage GdipGetImageEncoders GdipGetImageEncodersSize GdipFree GdipAlloc GdipDisposeImage GdipSaveImageToStream GdipCreateBitmapFromHBITMAP GdiplusShutdown

psapi

GetProcessImageFileNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_2fd6909dd9c7d518c436da2f3eefbda8_elex_mafia_stealc_x-agent

kernel32

user32

gdi32

advapi32

ole32

shlwapi

gdiplus

psapi

generic