2026-11-03_3459813d0b345b7cc201a2ec5c5b7cdf_elex_floxif_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_3459813d0b345b7cc201a2ec5c5b7cdf_elex_floxif_stealc_stop
Size 493KB
Sample261105-acdeqawsby
SHA256 62d059f3ab8b15c77c263f58da7d4ef42c878fd062ff92af031605e0cea5499b
MD5 3459813d0b345b7cc201a2ec5c5b7cdf
SHA1 cc4c72c24bbe3d0039eacd409706a954499c3956
SHA512 fe9a79a1c4b5ae906915dfc0b0a52b3a03f9cb22eed0b6270ec7b8430ee3626b041385ad38f33312726152e868e2769ed51450806237860bc7767602ca5d6153
SSDEEP 6144:ASTnH9jHdVahR7ZnwVXgC1mjVz765zKgWFB3aNip/BV+UdvrEFp7hKPfq:WhR7ZnwV/1mZz2KgWFRBjvrEH72fq
TLSH
T11AB428006680C239F3A217719E7ED5A855A8BC780B6591CFE3D839391EB59D39A3331F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-03_3459813d0b345b7cc201a2ec5c5b7cdf_elex_floxif_stealc_stop

File Explorer

2026-11-03_3459813d0b345b7cc201a2ec5c5b7cdf_elex_floxif_stealc_stop

.exe 493KB

2026-11-03_3459813d0b345b7cc201a2ec5c5b7cdf_elex_floxif_stealc_stop

IMPHASH 7cb88c8d9d928eb0f64cdbf3f7f953a1
SHA256 62d059f3ab8b15c77c263f58da7d4ef42c878fd062ff92af031605e0cea5499b
MD5 3459813d0b345b7cc201a2ec5c5b7cdf
SHA1 cc4c72c24bbe3d0039eacd409706a954499c3956
SHA512 fe9a79a1c4b5ae906915dfc0b0a52b3a03f9cb22eed0b6270ec7b8430ee3626b041385ad38f33312726152e868e2769ed51450806237860bc7767602ca5d6153
SSDEEP 6144:ASTnH9jHdVahR7ZnwVXgC1mjVz765zKgWFB3aNip/BV+UdvrEFp7hKPfq:WhR7ZnwV/1mZz2KgWFRBjvrEH72fq
TLSH
T11AB428006680C239F3A217719E7ED5A855A8BC780B6591CFE3D839391EB59D39A3331F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

fc:3a:55:28:c6:ea:e5:d4:0c:8e:de:bb:61:61:90:fe:2e:64:9e:1d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=ZTE CORPORATION,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ZTE CORPORATION,L=Shenzhen,ST=Guangdong,C=CN

Chains

Nov 4, 2013

CN=ZTE CORPORATION,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ZTE CORPORATION,L=Shenzhen,ST=Guangdong,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Subject

CN=ZTE CORPORATION,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ZTE CORPORATION,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

48:d6:38:3a:8d:14:9c:1c:dc:e6:9a:72:8b:dd:24:f6

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 9, 2012 - Apr 25, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

117980

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\aaa\Release\ZDServ\ZDServ.pdb

kernel32

HeapAlloc FormatMessageW MultiByteToWideChar LocalFree LocalAlloc TerminateProcess OpenMutexW CreateDirectoryW GetCurrentProcessId GetVersionExW SetLastError CreateFileW LoadLibraryExW GetPrivateProfileSectionW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetPrivateProfileStringW ReleaseMutex GetSystemTime CopyFileW GlobalUnlock GlobalLock GlobalAlloc GlobalFree InterlockedIncrement InterlockedDecrement CompareStringW LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree lstrcmpA lstrlenA lstrcmpW GlobalFlags GlobalAddAtomW SetFilePointer SetEndOfFile CompareStringA GetLocaleInfoW GlobalDeleteAtom GetVersionExA LoadLibraryA GlobalFindAtomW GetModuleHandleA GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess GetCommandLineA GetStartupInfoA RtlUnwind RaiseException HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeFormatA GetDateFormatA GetTimeZoneInformation LCMapStringA LCMapStringW GetConsoleCP GetConsoleMode SetHandleCount GetStdHandle GetFileType GetModuleFileNameA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount VirtualAlloc GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA SetEnvironmentVariableA DeleteFileW GetTempPathW GetPrivateProfileIntW CreateMutexW GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDrives Sleep OutputDebugStringW DisconnectNamedPipe FlushFileBuffers WriteFile ReadFile CreateThread WTSGetActiveConsoleSessionId GetProcessHeap HeapFree GetCurrentProcess GetExitCodeProcess LoadLibraryW FreeLibrary WaitForSingleObject CloseHandle WideCharToMultiByte LockResource GetCurrentThreadId SizeofResource LoadResource FindResourceW GetLastError GetModuleFileNameW lstrlenW GetProcAddress GetModuleHandleW

user32

GetClassLongW GetCapture WinHelpW LoadIconW RegisterWindowMessageW TabbedTextOutW DrawTextW DrawTextExW GrayStringW DestroyMenu CopyRect DefWindowProcW CallWindowProcW GetMenu SystemParametersInfoA GetWindowPlacement SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem PostQuitMessage SetForegroundWindow IsIconic PostMessageW SetWindowPos SetWindowLongW SetPropW GetDlgItem SetWindowsHookExW CallNextHookEx GetKeyState ValidateRect GetFocus ClientToScreen GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect SetWindowTextW GetWindowTextW GetWindowThreadProcessId SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW UnhookWindowsHookEx LoadCursorW GetSystemMetrics ReleaseDC GetSysColor GetSysColorBrush GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu PostThreadMessageW DispatchMessageW PeekMessageW GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetPropW RemovePropW GetForegroundWindow GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu IsWindow GetDC

advapi32

RegQueryValueExW GetTokenInformation SetTokenInformation DuplicateTokenEx OpenProcessToken CreateProcessAsUserW StartServiceCtrlDispatcherW StartServiceW DeregisterEventSource ReportEventW RegisterEventSourceW DeleteService ControlService CreateServiceW CloseServiceHandle OpenServiceW OpenSCManagerW RegisterServiceCtrlHandlerW SetServiceStatus RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW

shell32

ShellExecuteW ShellExecuteExW SHGetSpecialFolderPathW

shlwapi

PathRemoveFileSpecW PathFileExistsW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW CM_Get_Parent CM_Get_Device_IDW SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW CM_Get_Child CM_Get_Sibling SetupDiOpenDevRegKey

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

oleacc

LresultFromObject CreateStdAccessibleObject

gdi32

DeleteObject CreateBitmap GetClipBox SetTextColor SetBkColor SaveDC RestoreDC PtVisible GetDeviceCaps RectVisible TextOutW ExtTextOutW Escape SelectObject GetStockObject DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetMapMode SetViewportOrgEx

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

oleaut32

VariantClear VariantChangeType VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_3459813d0b345b7cc201a2ec5c5b7cdf_elex_floxif_stealc_stop

PE Signature issue

kernel32

user32

advapi32

shell32

shlwapi

userenv

wtsapi32

setupapi

version

oleacc

gdi32

winspool.drv

oleaut32

generic