2026-10-10_01f1479fc53d81900943dd0926c7e047_elex_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_01f1479fc53d81900943dd0926c7e047_elex_mafia
Size 1.0MB
Sample261011-2vd8hsaf64
SHA256 3877d38fb03d31823adcdb61f4cbb639c609ddc649ec98bf809314fa1cb9cdd7
MD5 01f1479fc53d81900943dd0926c7e047
SHA1 ed6c9135906a60e78cf3e38345e7bf3517e17871
SHA512 22eef171a2c76f92d327ab88a1ba4da9f8e6ac368b24420dd0ac66c2e50c203673ea79902fc77edbd25f2a9974b843cd8b30153f6d57618c37df7d3cd6bfc2df
SSDEEP 24576:Cv/Hb/xc758AHO5wTHpPbX08jkhhRt+4dKB7tmAVRiL9uV:u/HbK1uwTJTXXjk5yBhPq9uV
TLSH
T14035F16177E05072E2B72E319A3ADA214DBF7C7909B1844D63853A1D6E72BC0C978B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_01f1479fc53d81900943dd0926c7e047_elex_mafia

File Explorer

2026-10-10_01f1479fc53d81900943dd0926c7e047_elex_mafia

.exe 1.0MB

2026-10-10_01f1479fc53d81900943dd0926c7e047_elex_mafia

IMPHASH 48959a1be3682c2867eb1d2efdbbe662
SHA256 3877d38fb03d31823adcdb61f4cbb639c609ddc649ec98bf809314fa1cb9cdd7
MD5 01f1479fc53d81900943dd0926c7e047
SHA1 ed6c9135906a60e78cf3e38345e7bf3517e17871
SHA512 22eef171a2c76f92d327ab88a1ba4da9f8e6ac368b24420dd0ac66c2e50c203673ea79902fc77edbd25f2a9974b843cd8b30153f6d57618c37df7d3cd6bfc2df
SSDEEP 24576:Cv/Hb/xc758AHO5wTHpPbX08jkhhRt+4dKB7tmAVRiL9uV:u/HbK1uwTJTXXjk5yBhPq9uV
TLSH
T14035F16177E05072E2B72E319A3ADA214DBF7C7909B1844D63853A1D6E72BC0C978B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

93022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\ade\jenkins\workspace\8-2-build-windows-i586-cygwin\jdk8u241\331\build\windows-i586\deploy\jre-image\bin\javaws.pdb

kernel32

WideCharToMultiByte GetCurrentProcessId LoadLibraryW GetModuleHandleW FreeLibrary GetProcAddress GetTickCount CreateEventW CloseHandle WaitForSingleObject GetThreadLocale CreateDirectoryW GetSystemWindowsDirectoryW FindClose FindFirstFileW OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot GetModuleFileNameW InterlockedIncrement GlobalMemoryStatusEx GetVersionExW VerifyVersionInfoW VerSetConditionMask GetCurrentProcess GetNativeSystemInfo GlobalFree LocalFree GlobalAlloc GetLastError CreateFileW GetSystemDirectoryW CreateProcessW lstrlenW GetEnvironmentVariableW GetWindowsDirectoryW LocalAlloc FormatMessageW WTSGetActiveConsoleSessionId GetLongPathNameW GetShortPathNameW InterlockedDecrement GetTempPathW GetLocalTime OutputDebugStringW GetCurrentThreadId GetModuleHandleExW GetExitCodeProcess GetFileAttributesW GetOEMCP GetACP GetCPInfo FlushFileBuffers GetConsoleMode lstrlenA HeapSize WriteConsoleW CompareStringW LCMapStringW QueryPerformanceCounter IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID ReadFile GetProcessHeap GetConsoleCP IsValidCodePage DeleteCriticalSection GetEnvironmentStringsW SetEndOfFile SetFilePointer SetStdHandle SetHandleCount GetLocaleInfoW Sleep SetEnvironmentVariableW SetEnvironmentVariableA SetLastError TlsFree TlsSetValue TlsGetValue FreeEnvironmentStringsW TlsAlloc InterlockedExchange LoadLibraryA RaiseException FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW FindFirstFileExW HeapAlloc GetSystemTimeAsFileTime HeapFree HeapReAlloc GetStringTypeW ExitProcess DecodePointer RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteFileW GetFileType MultiByteToWideChar GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetCommandLineW HeapSetInformation GetStartupInfoW GetFullPathNameW GetFileInformationByHandle PeekNamedPipe GetCurrentDirectoryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess InitializeCriticalSectionAndSpinCount WriteFile GetStdHandle HeapCreate IsProcessorFeaturePresent

user32

MessageBoxW TranslateMessage GetMessageW SetTimer CreateWindowExW RegisterClassW LoadCursorW wsprintfW CloseDesktop OpenInputDesktop GetWindowThreadProcessId GetShellWindow DefWindowProcW DispatchMessageW

ole32

CoTaskMemFree StringFromCLSID

oleaut32

SysAllocStringByteLen SysAllocString SysFreeString VariantClear SysStringLen

wsock32

recv accept WSAAsyncSelect ntohs listen getsockname bind socket ioctlsocket htons connect send WSAGetLastError WSAStartup closesocket

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_01f1479fc53d81900943dd0926c7e047_elex_mafia

kernel32

user32

ole32

oleaut32

wsock32

generic