Elsify[.]exe | Triage™

Resubmissions

02/11/2026, 06:29

261102-g86vgafx5s6

01/11/2026, 22:29

261101-2d9m4az12n6

Sharing

Copy URL Twitter E-mail

General

Target
Elsify.exe
Size 40.0MB
Sample261102-g86vgafx5s
SHA256 d707be7484cf139f78f62b22e56b3cede4e71838465771b9f6389f0596c0346f
MD5 9ee4494343fe1bae95f6b5443771dd62
SHA1 5aee54d7da7896168919b77bc9b96ce186305b1f
SHA512 90a546ecf1c97af2863aba77d5604f464292e3a223fc3fb247498e01b5d5faacd762f2daaab303614236f085bf2101a2eac4c3cd39017293d8721adf9d0fd597
SSDEEP 393216:cUo6LGgjctJYGdPKRlRY4+koT1hiAgaI8AIpER:cUo6aZOGJqoT1hiAIR
TLSH
T186979D0323968E2ED99F1BBAE0D14325D739DA06A75793DB240C99991FC33C15A343FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Elsify.exe

.exe 40.0MB

Elsify.exe

IMPHASH 7a8c872f8e13d32f36a675b52eda1d6e
SHA256 d707be7484cf139f78f62b22e56b3cede4e71838465771b9f6389f0596c0346f
MD5 9ee4494343fe1bae95f6b5443771dd62
SHA1 5aee54d7da7896168919b77bc9b96ce186305b1f
SHA512 90a546ecf1c97af2863aba77d5604f464292e3a223fc3fb247498e01b5d5faacd762f2daaab303614236f085bf2101a2eac4c3cd39017293d8721adf9d0fd597
SSDEEP 393216:cUo6LGgjctJYGdPKRlRY4+koT1hiAgaI8AIpER:cUo6aZOGJqoT1hiAIR
TLSH
T186979D0323968E2ED99F1BBAE0D14325D739DA06A75793DB240C99991FC33C15A343FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

35:76:ce:66:eb:26:ee:a6:df:7d:28:1f:18:bc:94:73:3c:50:fc:0a:d8:e8:d6:4d:ef:90:3b:36:dd:64:51:1f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=2026-001931655,CN=FrostChanger LLC,O=FrostChanger LLC,L=Los Angeles,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#130757796f6d696e67,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Oct 4, 2026

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

Serial Number

04:76:e1:2b:2d:ad:70:36:cc:18:27:b0:5f:6a:56:06

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 24, 2026 - Jul 26, 2027

Subject

CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 18, 2025 - Nov 12, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

75232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

shell32

ShellExecuteW

advapi32

RegCloseKey ReportEventW RegisterEventSourceW RegOpenKeyExW RegGetValueW DeregisterEventSource

kernel32

GetSystemTimeAsFileTime TlsFree CreateActCtxW ActivateActCtx GetLastError FindResourceW GetWindowsDirectoryW GetProcAddress GetModuleHandleW FreeLibrary LoadLibraryExW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetStdHandle GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW FindClose MultiByteToWideChar GetConsoleMode GetFileAttributesExW LoadLibraryA WriteConsoleW DeleteCriticalSection WideCharToMultiByte IsWow64Process OutputDebugStringW TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter

user32

MessageBoxW

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _exit exit _initterm_e _errno _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table abort _invoke_watson

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc malloc _callnewh free

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s wcsftime

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf __p__commode fputwc __acrt_iob_func __stdio_common_vswprintf _set_fmode _wfsopen fflush setvbuf __stdio_common_vsnwprintf_s

api-ms-win-crt-locale-l1-1-0

_create_locale ___mb_cur_max_func ___lc_codepage_func ___lc_locale_name_func __pctype_func _configthreadlocale setlocale _lock_locales _free_locale _unlock_locales

api-ms-win-crt-string-l1-1-0

strlen strcmp wcsncmp toupper strcpy_s _wcsdup wcsnlen

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

api-ms-win-crt-math-l1-1-0

__setusermatherr

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Elsify.exe

shell32

advapi32

kernel32

user32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

generic