2026-10-21_9a055280261f3c4244524ed1545f65e1_elex_mafia_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_9a055280261f3c4244524ed1545f65e1_elex_mafia_stealc_tofsee
Size 253KB
Sample261022-tj656avy7n
SHA256 083fb59a3dd1a182021875294aa6790de0dae5020a471738562959184a44b56f
MD5 9a055280261f3c4244524ed1545f65e1
SHA1 2c7863a3effd29b04419d42110bf8d6236f7f36e
SHA512 f27cdb64e9e2140e09fc48d2a88b537466b9475dcc079c9d3d0a4a2a75f2fda80355053cdf960e7388f034e9b333832726ca3d5b2b642d2331cebb001a38a854
SSDEEP 3072:mNJ1RuoNhLzAKjezQrhmwHhHsDYSip+Z5cxxGNi8axck/Erq60RY9ovO:uR9jLqzQ9hFcWxGNQxmm60RKovO
TLSH
T14744AE357681C073C5AB11318DF997BA5DAEB8A2477464CBE7D40BBE5F203E2963430A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_9a055280261f3c4244524ed1545f65e1_elex_mafia_stealc_tofsee

File Explorer

2026-10-21_9a055280261f3c4244524ed1545f65e1_elex_mafia_stealc_tofsee

.exe 253KB

2026-10-21_9a055280261f3c4244524ed1545f65e1_elex_mafia_stealc_tofsee

IMPHASH f66d08af5c3970b3c49cecedb683ba17
SHA256 083fb59a3dd1a182021875294aa6790de0dae5020a471738562959184a44b56f
MD5 9a055280261f3c4244524ed1545f65e1
SHA1 2c7863a3effd29b04419d42110bf8d6236f7f36e
SHA512 f27cdb64e9e2140e09fc48d2a88b537466b9475dcc079c9d3d0a4a2a75f2fda80355053cdf960e7388f034e9b333832726ca3d5b2b642d2331cebb001a38a854
SSDEEP 3072:mNJ1RuoNhLzAKjezQrhmwHhHsDYSip+Z5cxxGNi8axck/Erq60RY9ovO:uR9jLqzQ9hFcWxGNQxmm60RKovO
TLSH
T14744AE357681C073C5AB11318DF997BA5DAEB8A2477464CBE7D40BBE5F203E2963430A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71515

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

socket closesocket WSAStartup WSACleanup send connect htons sendto recv gethostbyname

psapi

GetModuleBaseNameA EnumProcesses

urlmon

URLDownloadToFileA

kernel32

GetConsoleCP SetFilePointer HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW GetSystemTimeAsFileTime GetComputerNameA CreateFileA FindResourceA FreeResource FreeLibrary LoadResource HeapAlloc GetCurrentProcess HeapFree GetTickCount GetProcessHeap ExpandEnvironmentStringsA CreateRemoteThread GetWindowsDirectoryA WriteFile OpenProcess GetConsoleMode Sleep SizeofResource GetFileAttributesA CreateProcessA GetEnvironmentVariableA GetLastError lstrcmpiA GetProcAddress CopyFileA SetFileAttributesA VirtualAllocEx LoadLibraryA LockResource GetSystemInfo GetModuleFileNameA GetModuleHandleA CreateMutexA GetVersionExA CloseHandle GetTempPathA WriteProcessMemory DeleteFileA CreateThread lstrlenA SetErrorMode SetStdHandle FlushFileBuffers WriteConsoleW SetEndOfFile ReadFile GetVolumeInformationA WideCharToMultiByte GetCurrentProcessId QueryPerformanceCounter CreateFileW InterlockedIncrement InterlockedDecrement InterlockedExchange MultiByteToWideChar EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleW ExitProcess GetCommandLineA HeapSetInformation GetStartupInfoW GetCPInfo RaiseException RtlUnwind LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapCreate GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId InitializeCriticalSectionAndSpinCount LoadLibraryW GetLocaleInfoW GetStdHandle GetModuleFileNameW HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey

shell32

ShellExecuteA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_9a055280261f3c4244524ed1545f65e1_elex_mafia_stealc_tofsee

ws2_32

psapi

urlmon

kernel32

advapi32

shell32

generic