2026-10-28_5ba41c574ca4909ade4428af172e1656_elex_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_5ba41c574ca4909ade4428af172e1656_elex_stop
Size 480KB
Sample261030-ece1rsws6p
SHA256 b9392506fbd9173ccb103fdebc212ea06cfb58dbb296eeaaba21a562707cd5aa
MD5 5ba41c574ca4909ade4428af172e1656
SHA1 f39485eefc1e87616e0309796ffaa133533fe124
SHA512 843e4032266d4a4f720c4cd1a5fb853ed61c66dcd826ba9e9fde9639ee83c1eac082cf4e137ab565fb6b7db1fb8d24f6baef15b73b9b60e2e914137c63cb115b
SSDEEP 12288:YkEhGZrZzVrsB5fVbwJzyi2f+NnFnGs62wa4lL8eUHjcsV:Tp2f+NnFnGszh4lL8Vjb
TLSH
T1EBA45B1271408026D8B311BD994AAB729C7D6533933900D7F3D54EAA5BBA4C1733EBEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_5ba41c574ca4909ade4428af172e1656_elex_stop

File Explorer

2026-10-28_5ba41c574ca4909ade4428af172e1656_elex_stop

.exe 480KB

2026-10-28_5ba41c574ca4909ade4428af172e1656_elex_stop

IMPHASH 27852dd51680a6338c6ce6ee3556cbf8
SHA256 b9392506fbd9173ccb103fdebc212ea06cfb58dbb296eeaaba21a562707cd5aa
MD5 5ba41c574ca4909ade4428af172e1656
SHA1 f39485eefc1e87616e0309796ffaa133533fe124
SHA512 843e4032266d4a4f720c4cd1a5fb853ed61c66dcd826ba9e9fde9639ee83c1eac082cf4e137ab565fb6b7db1fb8d24f6baef15b73b9b60e2e914137c63cb115b
SSDEEP 12288:YkEhGZrZzVrsB5fVbwJzyi2f+NnFnGs62wa4lL8eUHjcsV:Tp2f+NnFnGszh4lL8Vjb
TLSH
T1EBA45B1271408026D8B311BD994AAB729C7D6533933900D7F3D54EAA5BBA4C1733EBEB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

195820

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\workarea\13.101.1\drivers\2d\dal\eeu\build\client\w8\B_rel\atieclxx.pdb

user32

RegisterWindowMessageA GetMessageA DispatchMessageA BroadcastSystemMessageA PostMessageA DefWindowProcA RegisterClassA CreateWindowExA DestroyWindow GetForegroundWindow GetThreadDesktop CloseDesktop SetThreadDesktop OpenInputDesktop SystemParametersInfoA PostThreadMessageA UnregisterPowerSettingNotification RegisterPowerSettingNotification UnregisterDeviceNotification RegisterDeviceNotificationA EnumDisplaySettingsExA EnumWindows FindWindowA GetPropA SendMessageA EnumDisplayDevicesA RedrawWindow SendInput EnumDisplaySettingsA ChangeDisplaySettingsExA ChangeWindowMessageFilter UpdateWindow KillTimer SetTimer ShowWindow PostQuitMessage

gdi32

D3DKMTCloseAdapter D3DKMTInvalidateActiveVidPn D3DKMTPollDisplayChildren D3DKMTEscape D3DKMTOpenAdapterFromHdc D3DKMTQueryAdapterInfo SetDeviceGammaRamp DeleteDC CreateDCA

advapi32

RegQueryValueExA ReportEventA RegisterEventSourceA RegGetValueW RegGetValueA RegSetValueExW RegDeleteValueA RegDeleteKeyA RegOpenCurrentUser SetSecurityDescriptorDacl RevertToSelf InitializeSecurityDescriptor ImpersonateLoggedOnUser RegDeleteTreeA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey GetCurrentHwProfileA

userenv

UnloadUserProfile LoadUserProfileA

wtsapi32

WTSQueryUserToken WTSQuerySessionInformationA WTSFreeMemory WTSRegisterSessionNotification

powrprof

PowerReadACValueIndex PowerReadDCValueIndex PowerReadSettingAttributes PowerWriteFriendlyName PowerWritePossibleValue PowerWritePossibleFriendlyName PowerWriteACDefaultIndex PowerWriteDCDefaultIndex PowerWriteSettingAttributes PowerRemovePowerSetting PowerCreateSetting PowerCreatePossibleSetting PowerEnumerate PowerSetActiveScheme PowerGetActiveScheme PowerSettingAccessCheck PowerWriteACValueIndex PowerWriteDCValueIndex

setupapi

CM_Get_Parent CM_Get_Device_IDA CM_Locate_DevNodeA CM_Reenumerate_DevNode CM_Request_Eject_PC CM_Get_Child_Ex CM_Get_Device_ID_ExA CM_Get_DevNode_Status SetupDiOpenDeviceInfoA SetupDiGetDeviceInstanceIdA SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiCallClassInstaller SetupDiGetHwProfileList SetupDiGetDeviceRegistryPropertyA SetupDiSetClassInstallParamsA

dwmapi

ord102 DwmIsCompositionEnabled

kernel32

GetStringTypeW EnumSystemLocalesA WriteConsoleA GetStringTypeA GetLocaleInfoA RaiseException MultiByteToWideChar GetDateFormatA GetTimeFormatA LCMapStringA InitializeCriticalSectionAndSpinCount InterlockedExchange GetConsoleOutputCP LoadLibraryExA SetConsoleCtrlHandler SetStdHandle IsValidLocale WriteConsoleW CreateFileA GetLocaleInfoW GetTimeZoneInformation GetSystemInfo VirtualProtect VirtualQuery SetEndOfFile GetProcessHeap ReadFile ReadConsoleW HeapSize SetEnvironmentVariableA CompareStringW CompareStringA GetUserDefaultLCID SetFilePointer VirtualAlloc HeapReAlloc FatalAppExitA GetConsoleMode GetConsoleCP FlushFileBuffers LeaveCriticalSection EnterCriticalSection FreeEnvironmentStringsW FreeEnvironmentStringsA GetEnvironmentStringsW GetEnvironmentStrings GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter SetHandleCount DeleteCriticalSection GetFileType VirtualFree HeapDestroy HeapCreate GetModuleFileNameA WriteFile GetStdHandle LoadLibraryExW ExitProcess GetModuleHandleA LCMapStringW GetCPInfo GetOEMCP GetACP IsValidCodePage GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentThread SetLastError HeapAlloc HeapFree IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoA Sleep MapViewOfFile OpenFileMappingA OutputDebugStringA WTSGetActiveConsoleSessionId LocalFree CloseHandle GetLastError CreateProcessA OpenProcess lstrlenW QueryFullProcessImageNameW GetLocalTime GetExitCodeThread GetTickCount GetSystemPowerStatus InterlockedIncrement InterlockedDecrement SetEvent ResetEvent WaitForSingleObject CreateEventA OpenEventA WaitForMultipleObjects GetSystemDirectoryA GetVersionExA GetCurrentThreadId CreateThread SetThreadPriority ReleaseMutex CreateMutexA OpenMutexA FreeLibrary GetProcAddress WinExec LoadLibraryA RtlUnwind WideCharToMultiByte GetCommandLineA

ole32

PropVariantClear CoCreateInstance CoUninitialize CoInitialize

shlwapi

wnsprintfW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_5ba41c574ca4909ade4428af172e1656_elex_stop

user32

gdi32

advapi32

userenv

wtsapi32

powrprof

setupapi

dwmapi

kernel32

ole32

shlwapi

generic