2026-10-01_88c4620e4faba514e338c694aa8c6df6_elex_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_88c4620e4faba514e338c694aa8c6df6_elex_stealc_stop
Size 4.3MB
Sample261003-yl85rawfjb
SHA256 dd35ebfd85875954e8f1004508bfcb88f495f4737c420e357e26b14cd6fa4ff5
MD5 88c4620e4faba514e338c694aa8c6df6
SHA1 90fbc3c6df82338e6d9ec9a20f13e40fb9085078
SHA512 0dd16d1bda40faefe535a498d0e80e6ce28af1bad5085d70cd629a89e2cb70467022541d34a936e92321c5575d6e37e5b24f3e395df3900123e22abeeab40b0f
SSDEEP 98304:tdW1yAl9hCs/T7dTt3X0nMFaUgRQq0mQf/Kzp6icwm:+kICM7dB4A2RQQYicwm
TLSH
T1AF260151E3F850A0E5B33A749C7456DF09237F639B7486DB52383D1A4B3E69CA836322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-01_88c4620e4faba514e338c694aa8c6df6_elex_stealc_stop

.exe 4.3MB

2026-10-01_88c4620e4faba514e338c694aa8c6df6_elex_stealc_stop

IMPHASH b48671fed9d5ca4906417d42fcdb066b
SHA256 dd35ebfd85875954e8f1004508bfcb88f495f4737c420e357e26b14cd6fa4ff5
MD5 88c4620e4faba514e338c694aa8c6df6
SHA1 90fbc3c6df82338e6d9ec9a20f13e40fb9085078
SHA512 0dd16d1bda40faefe535a498d0e80e6ce28af1bad5085d70cd629a89e2cb70467022541d34a936e92321c5575d6e37e5b24f3e395df3900123e22abeeab40b0f
SSDEEP 98304:tdW1yAl9hCs/T7dTt3X0nMFaUgRQq0mQf/Kzp6icwm:+kICM7dB4A2RQQYicwm
TLSH
T1AF260151E3F850A0E5B33A749C7456DF09237F639B7486DB52383D1A4B3E69CA836322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

21:0d:7b:ef:48:0d:75:f1:2f:db:53:e3:f4:e7:db:cb:10:f8:df:aa:5f:8b:9e:f9:dd:54:58:28:e3:c8:d8:50

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=68 643 065 114,CN=Winthrop Development Consultants Pty Ltd,O=Winthrop Development Consultants Pty Ltd,POSTALCODE=6150,STREET=52 Sutherland Crescent,L=Winthrop,ST=Western Australia,C=AU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024155

Chains

May 2, 2023

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

5d:f4:c8:06:43:20:18:68:0a:71:8e:18:6b:9b:5c:b1:93:aa:8e:bc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

May 2, 2023

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 3, 2014 - Dec 2, 2029

Subject

Serial Number

6d:f9:06:4b:3a:79:19:63:9f:66:8d:49:07:29:39:7d

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 31, 2020 - Jul 31, 2023

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Minor OS version

Major OS version

Entry point

142424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError ResetEvent CreateEventW CloseHandle MultiByteToWideChar WideCharToMultiByte FreeLibrary LoadLibraryW GetModuleFileNameW FormatMessageW LocalFree GetWindowsDirectoryW CreateFileW SetFileTime SetFileAttributesW RemoveDirectoryW CreateDirectoryW GetFileInformationByHandle DeleteFileW GetShortPathNameW GetFullPathNameW lstrlenW GetCurrentDirectoryW GetTempFileNameW FindClose FindFirstFileW FindNextFileW GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile DeleteCriticalSection GetStdHandle EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects GetCurrentProcessId InitializeCriticalSection QueryPerformanceCounter GetTickCount Sleep LocalAlloc GetProcAddress SetCurrentDirectoryW GetSystemDefaultUILanguage GetUserDefaultUILanguage SetThreadUILanguage SetThreadLocale GetVersion GetCommandLineW CreateProcessW GetExitCodeProcess FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetConsoleMode GetConsoleCP GetLocaleInfoA IsValidCodePage GetOEMCP RaiseException GetACP GetCPInfo LoadLibraryA RtlUnwind InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime WaitForSingleObject SetEvent GetVersionExW VirtualAlloc GetCurrentThreadId VirtualFree GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapSize InterlockedDecrement SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc HeapFree HeapAlloc ExitThread CreateThread HeapReAlloc GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate GetModuleHandleW ExitProcess GetModuleFileNameA TlsGetValue

user32

SetForegroundWindow CharUpperW GetWindowRect DestroyWindow RegisterWindowMessageW AdjustWindowRect LoadImageW LoadIconW KillTimer SetTimer EndDialog IsDlgButtonChecked SetDlgItemTextW GetDlgItem SetWindowTextW GetWindowTextW GetWindowTextLengthW LoadStringW DialogBoxParamW CreateDialogParamW SystemParametersInfoW PeekMessageW GetDesktopWindow MessageBoxW SendMessageW GetWindowLongW SetWindowLongW ShowWindow MoveWindow PostMessageW

gdi32

GetObjectW

advapi32

RegSetValueExW RegCreateKeyExW RegCloseKey

shell32

SHGetFolderPathW ShellExecuteExW

ole32

CoInitializeEx CoInitialize CoCreateInstance

oleaut32

SysAllocStringLen SysFreeString VariantClear SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_88c4620e4faba514e338c694aa8c6df6_elex_stealc_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic