General
- Target 2026-11-05_2abdeaa9c79e024fa11904ba88a1b775_elex_stealc_stop_tofsee
- Size 266KB
- Sample261107-gsfncaeb52
- SHA256 a0aa18e9d9f50acf2b8cb77c10eb86c61de02cd4406b8d52f848dadfd798e6e9
- MD5 2abdeaa9c79e024fa11904ba88a1b775
- SHA1 c08e9ec6a95ab5a9c453ae8ee2c1cd5279445b56
- SHA512 408cd231d876a16b478b2276dbaba39b926a34db9ef9ff73d5d46e2932e6d503542133c89320a9ca844dca9a6a385eead79dbc5550c44c2c80905cb69b35c4d3
- SSDEEP 3072:AUApueDWSppTaeskDEjUrqfkZ557YzAL9gFoI3X3fZE5UANax:ASeyGpTaesaQUufkL57YsL9NIx9ANax
- TLSH T1BC444C213680C032E366173049E6E6F459A97D794AA4E64FF7B47F391E315938A3720F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-11-05_2abdeaa9c79e024fa11904ba88a1b775_elex_stealc_stop_tofsee.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-05_2abdeaa9c79e024fa11904ba88a1b775_elex_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
112.175.88.207
-
112.175.88.208
Targets
-
- Target 2026-11-05_2abdeaa9c79e024fa11904ba88a1b775_elex_stealc_stop_tofsee
- Size 266KB
- SHA256 a0aa18e9d9f50acf2b8cb77c10eb86c61de02cd4406b8d52f848dadfd798e6e9
- MD5 2abdeaa9c79e024fa11904ba88a1b775
- SHA1 c08e9ec6a95ab5a9c453ae8ee2c1cd5279445b56
- SHA512 408cd231d876a16b478b2276dbaba39b926a34db9ef9ff73d5d46e2932e6d503542133c89320a9ca844dca9a6a385eead79dbc5550c44c2c80905cb69b35c4d3
- SSDEEP 3072:AUApueDWSppTaeskDEjUrqfkZ557YzAL9gFoI3X3fZE5UANax:ASeyGpTaesaQUufkL57YsL9NIx9ANax
- TLSH T1BC444C213680C032E366173049E6E6F459A97D794AA4E64FF7B47F391E315938A3720F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE