2026-10-31_e347a6d08f763dd87c8af5c7084db5de_elex_maze_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_e347a6d08f763dd87c8af5c7084db5de_elex_maze_stealc
Size 2.4MB
Sample261101-xtklpaev8m
SHA256 5da2ae6874b38b0f8344ab0fbd71a816666708175f1d8b5beeb4a317ec7c03f5
MD5 e347a6d08f763dd87c8af5c7084db5de
SHA1 21159491cee85bff02c6bfbeba03f55b118352d4
SHA512 abb12a514a66b379b541bb18d0c6174627f7c91eacdd45fef0f74fc954752802983e966bed2ad9019c35752d30617dec1195f4061d2d2829fa7641b1e83945ba
SSDEEP 49152:2q+9v+I7LA14KsXdi93GBWLaGXkoAyCKdzg:2vPAuKse4QXZzg
TLSH
T100C511107A82C035E5A202B16E2DDB36647DB8705B7556CBF7C44F6E1A709C2BB36B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_e347a6d08f763dd87c8af5c7084db5de_elex_maze_stealc

File Explorer

2026-10-31_e347a6d08f763dd87c8af5c7084db5de_elex_maze_stealc

.exe 2.4MB

2026-10-31_e347a6d08f763dd87c8af5c7084db5de_elex_maze_stealc

IMPHASH 3bd440d0afb0f13184f73e29b680835f
SHA256 5da2ae6874b38b0f8344ab0fbd71a816666708175f1d8b5beeb4a317ec7c03f5
MD5 e347a6d08f763dd87c8af5c7084db5de
SHA1 21159491cee85bff02c6bfbeba03f55b118352d4
SHA512 abb12a514a66b379b541bb18d0c6174627f7c91eacdd45fef0f74fc954752802983e966bed2ad9019c35752d30617dec1195f4061d2d2829fa7641b1e83945ba
SSDEEP 49152:2q+9v+I7LA14KsXdi93GBWLaGXkoAyCKdzg:2vPAuKse4QXZzg
TLSH
T100C511107A82C035E5A202B16E2DDB36647DB8705B7556CBF7C44F6E1A709C2BB36B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

186696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\build\workspace\miflash_git\out\Release\bin\recovery.pdb

shlwapi

SHCreateStreamOnFileEx

kernel32

GetUserDefaultLangID Process32FirstW Process32NextW CreateToolhelp32Snapshot SetEvent ResetEvent WaitForMultipleObjects GetCurrentProcess CreateDirectoryW GetFileAttributesW ReadFile GetTempPathW GetCurrentDirectoryW SetLastError GetFileAttributesExW DeleteFileW WideCharToMultiByte MultiByteToWideChar InterlockedCompareExchange SystemTimeToTzSpecificLocalTime QueryPerformanceCounter GetSystemTimeAsFileTime FileTimeToSystemTime SetEndOfFile SetFilePointerEx FlushFileBuffers CreateMutexW SetFilePointer CreateProcessW WaitForSingleObject FormatMessageA GetModuleFileNameW GetModuleHandleA ReleaseMutex GetCurrentProcessId GetNativeSystemInfo GetModuleHandleW GetVersionExW GetProcAddress GetCurrentThreadId InterlockedExchangeAdd LeaveCriticalSection EnterCriticalSection DeleteCriticalSection Sleep RaiseException IsDebuggerPresent CreateThread CreateEventW GetModuleHandleExW TlsGetValue TlsSetValue TlsAlloc TlsFree CloseHandle GetDriveTypeW GetSystemDirectoryW OutputDebugStringW GetLocalTime GetEnvironmentStringsW FreeEnvironmentStringsW DecodePointer SetUnhandledExceptionFilter GetComputerNameW EncodePointer GetStringTypeW IsProcessorFeaturePresent HeapFree HeapAlloc ExitProcess AreFileApisANSI HeapReAlloc GetCommandLineA GetFullPathNameW SetStdHandle GetFileType GetProcessHeap GetConsoleCP GetConsoleMode LoadLibraryExW ReadConsoleW RtlUnwind GetCPInfo UnhandledExceptionFilter TerminateProcess GetStartupInfoW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle HeapSize IsValidCodePage GetACP GetOEMCP GetModuleFileNameA GetTimeZoneInformation WriteConsoleW SetEnvironmentVariableA CreateFileW WriteFile CreateFileMappingW UnmapViewOfFile MapViewOfFile GetTickCount SetConsoleCtrlHandler GetLastError GetWindowsDirectoryW InitializeCriticalSectionAndSpinCount

ole32

CoTaskMemFree CoCreateInstance CoUninitialize CoInitializeEx

dbghelp

MiniDumpWriteDump

winmm

timeGetTime

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW CM_Get_DevNode_Status_Ex CM_Disconnect_Machine CM_Get_Child_Ex CM_Connect_MachineW CM_Get_Sibling_Ex CM_Get_Device_ID_ExW CM_Locate_DevNode_ExW CM_Get_DevNode_Registry_PropertyW

user32

MessageBoxW GetActiveWindow

advapi32

IsTextUnicode

shell32

SHGetFolderPathW SHFileOperationW

adbwinapi

AdbGetUsbDeviceDescriptor AdbNextInterface AdbEnumInterfaces AdbGetSerialNumber AdbOpenEndpoint AdbOpenDefaultBulkReadEndpoint AdbReadEndpointSync AdbCreateInterfaceByName AdbOpenDefaultBulkWriteEndpoint AdbWriteEndpointSync AdbGetEndpointInformation AdbCloseHandle AdbGetUsbInterfaceDescriptor

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

311KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_e347a6d08f763dd87c8af5c7084db5de_elex_maze_stealc

shlwapi

kernel32

ole32

dbghelp

winmm

setupapi

user32

advapi32

shell32

adbwinapi

version

generic