2026-11-08_540dd79436a1be922a380047ea47107e_elex_floxif_mafia_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-08_540dd79436a1be922a380047ea47107e_elex_floxif_mafia_stealc
Size 1.4MB
Sample261109-d7fp4stt6k
SHA256 19e131a348fe6664a4651eb63598834aeaf550bab3fece3eef2c8de17ad0f341
MD5 540dd79436a1be922a380047ea47107e
SHA1 009c046f57e7f5ef478e6bb799d653385d2ad85a
SHA512 30443b4caaa2f4ad53b3860d5cdb73a227ebddb22bb7c6c5f5946b27490f83b948758f3623fd7347eb94c34bfd89a0893e2967d54c2fa0f1862681251dfba35d
SSDEEP 24576:tKAd/monVAqRVzkBhtS6sjRiJ8Tr5wWjsrwrPsrf8NRbAraf2jzD/rEH7r:csnVAqR8S6sFi6T1wWjskbswNRkUCzu
TLSH
T12E65BF2176D2C136D2730572AABCA769557DFF350B2284CFA3C8096D3EB45D2AA32317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-08_540dd79436a1be922a380047ea47107e_elex_floxif_mafia_stealc

File Explorer

2026-11-08_540dd79436a1be922a380047ea47107e_elex_floxif_mafia_stealc

.exe 1.4MB

2026-11-08_540dd79436a1be922a380047ea47107e_elex_floxif_mafia_stealc

IMPHASH a29f8be6e2252e9e209c5513e4a225a8
SHA256 19e131a348fe6664a4651eb63598834aeaf550bab3fece3eef2c8de17ad0f341
MD5 540dd79436a1be922a380047ea47107e
SHA1 009c046f57e7f5ef478e6bb799d653385d2ad85a
SHA512 30443b4caaa2f4ad53b3860d5cdb73a227ebddb22bb7c6c5f5946b27490f83b948758f3623fd7347eb94c34bfd89a0893e2967d54c2fa0f1862681251dfba35d
SSDEEP 24576:tKAd/monVAqRVzkBhtS6sjRiJ8Tr5wWjsrwrPsrf8NRbAraf2jzD/rEH7r:csnVAqR8S6sFi6T1wWjskbswNRkUCzu
TLSH
T12E65BF2176D2C136D2730572AABCA769557DFF350B2284CFA3C8096D3EB45D2AA32317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

fa:23:48:44:45:ea:5c:62:db:ae:34:37:f3:90:3c:fc:8e:44:fc:2d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Chains

Jan 15, 2016

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Baidu Online Network Technology (Beijing) Co.\,Ltd.,OU=Baidu security,O=Baidu Online Network Technology (Beijing) Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Serial Number

5f:ae:e9:e8:3f:32:94:8f:3b:20:40:ac:6d:f0:14:5c

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2015 - Mar 25, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

549762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\ci\workspace\nbrowser_bdupdate_m12_branch\bdupdate\output\SparkUpdate.pdb

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ws2_32

WSAGetLastError getaddrinfo getnameinfo WSAStartup gethostname freeaddrinfo

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

imm32

ImmDisableIME

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

psapi

EnumProcesses EnumProcessModules GetModuleInformation GetModuleFileNameExW

kernel32

TerminateProcess FlushInstructionCache GetCurrentProcess SetLastError Sleep TerminateThread ResetEvent SetEvent SetThreadPriority WaitForMultipleObjects CreateEventW GetPrivateProfileStringW WritePrivateProfileStringW GetVersionExW MoveFileExW FindClose FindNextFileW FindFirstFileW GetTempPathW ReleaseMutex lstrcpyW InitializeCriticalSection GetFullPathNameW SetCurrentDirectoryW CreateMutexW OutputDebugStringW GetSystemTime GetCommandLineW FreeConsole GetConsoleScreenBufferInfo GetStdHandle AllocConsole WriteConsoleW SetConsoleTextAttribute GetCurrentProcessId GetPrivateProfileIntW SetProcessAffinityMask lstrcmpiW LoadLibraryExW OpenFileMappingW VirtualQuery CreateProcessW ExitProcess OpenEventW HeapAlloc GetProcessHeap HeapFree OpenMutexW GetExitCodeProcess WTSGetActiveConsoleSessionId DeviceIoControl GetSystemInfo WaitForSingleObject GetVolumeInformationA ExpandEnvironmentStringsW LeaveCriticalSection GetFileAttributesExW GlobalFree GlobalAlloc GetShortPathNameW Process32NextW Process32FirstW CreateToolhelp32Snapshot lstrlenA VirtualProtect HeapCreate AddVectoredExceptionHandler SetUnhandledExceptionFilter RemoveVectoredExceptionHandler ProcessIdToSessionId InterlockedExchange InterlockedCompareExchange GetFileSizeEx ReadProcessMemory VirtualQueryEx QueueUserWorkItem InterlockedExchangeAdd GetSystemTimeAsFileTime InterlockedDecrement QueryPerformanceCounter SetFilePointerEx SetFileValidData GetModuleFileNameA GetModuleHandleA CreateFileA GetPrivateProfileSectionW GetPrivateProfileSectionNamesW GetTempFileNameW GetDiskFreeSpaceExW GetVolumeInformationW GetDriveTypeW GetLogicalDrives InterlockedPopEntrySList EncodePointer OpenProcess GetModuleHandleW CopyFileW GetModuleFileNameW EnterCriticalSection lstrlenW DecodePointer RtlUnwind DeleteCriticalSection InitializeCriticalSectionAndSpinCount LocalFree FormatMessageW DeleteFileW FreeLibrary SetEndOfFile GetLastError TlsFree DosDateTimeToFileTime SetFileAttributesW TlsSetValue TlsGetValue GetConsoleCP GetConsoleMode ExitThread CreateThread GetTimeFormatW GetDateFormatW ResumeThread GetCommandLineA HeapSetInformation GetStartupInfoW LCMapStringW GetCPInfo UnhandledExceptionFilter IsDebuggerPresent SetHandleCount GetFileType GetCurrentThreadId TlsAlloc GetTickCount UnmapViewOfFile GetLocalTime CreateFileMappingW MapViewOfFile GetFileSize WriteFile SetFileTime GetFileAttributesW CreateDirectoryW GetCurrentDirectoryW WideCharToMultiByte LocalFileTimeToFileTime SystemTimeToFileTime ReadFile CloseHandle CreateFileW SetFilePointer MultiByteToWideChar LoadLibraryW GetProcAddress FindResourceExW FindResourceW LoadResource LockResource SizeofResource RaiseException VirtualAlloc VirtualFree IsProcessorFeaturePresent InterlockedPushEntrySList HeapSize FlushFileBuffers GetACP GetOEMCP QueryPerformanceFrequency InterlockedIncrement IsValidCodePage SetStdHandle GetLocaleInfoW GetTimeZoneInformation GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW CompareStringW SetEnvironmentVariableA HeapReAlloc RemoveDirectoryW HeapDestroy

user32

GetCursorPos TrackPopupMenu DestroyMenu SetFocus GetSystemMetrics RegisterWindowMessageW CreatePopupMenu GetAsyncKeyState LoadIconW MessageBoxW CallWindowProcW GetWindowLongW LoadCursorW GetClassInfoExW SetWindowLongW AllowSetForegroundWindow DialogBoxParamW PostThreadMessageW GetMessageW TranslateMessage RegisterClassExW CreateWindowExW ShowWindow SetTimer DestroyWindow SetWindowTextW LoadImageW DefWindowProcW KillTimer GetForegroundWindow GetWindowThreadProcessId InsertMenuW AttachThreadInput BringWindowToTop SetForegroundWindow SetActiveWindow IsIconic SendMessageW IsWindow DestroyIcon PostMessageW GetDesktopWindow wsprintfW CharNextW UnregisterClassA DispatchMessageW

gdi32

GetStockObject

advapi32

GetExplicitEntriesFromAclW LookupAccountSidW ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumKeyExW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW GetUserNameW GetTokenInformation RegQueryValueExA RegOpenKeyExW RegQueryValueExW OpenProcessToken RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExA RegEnumKeyExA SetTokenInformation SetSecurityInfo SetEntriesInAclW GetSecurityInfo SetSecurityDescriptorSacl GetSecurityDescriptorSacl SetSecurityDescriptorDacl InitializeSecurityDescriptor StartServiceW CloseServiceHandle OpenServiceW OpenSCManagerW CreateProcessAsUserW DuplicateTokenEx RegEnumValueW QueryServiceStatusEx CryptReleaseContext CryptDecrypt CryptDeriveKey CryptHashData CryptCreateHash CryptAcquireContextW SetNamedSecurityInfoW GetNamedSecurityInfoW SetServiceStatus SetServiceObjectSecurity BuildExplicitAccessWithNameW GetSecurityDescriptorDacl QueryServiceObjectSecurity RegOpenKeyW DeleteService ControlService ChangeServiceConfig2W CreateServiceW RegCreateKeyW RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RevertToSelf RegQueryInfoKeyW

shell32

ShellExecuteExW SHGetFolderPathW ShellExecuteW SHCreateDirectoryExW ord165 SHFileOperationW CommandLineToArgvW SHGetSpecialFolderPathW Shell_NotifyIconW

ole32

CoInitialize CoUninitialize CoInitializeEx CoCreateInstance OleInitialize CoTaskMemAlloc CoTaskMemFree CoCreateGuid CLSIDFromProgID CoTaskMemRealloc

oleaut32

SysAllocStringLen SysStringLen LoadRegTypeLi LoadTypeLi SysAllocString VariantClear VarUI4FromStr VarBstrCmp VariantInit SysFreeString

shlwapi

PathAppendW PathFileExistsW PathRemoveFileSpecW SHSetValueW SHGetValueW PathIsDirectoryW PathFindExtensionW PathGetDriveNumberW PathStripPathW PathRemoveExtensionW PathCombineW PathFindFileNameW

iphlpapi

GetIpForwardTable GetAdaptersAddresses GetAdaptersInfo

rpcrt4

RpcStringFreeW UuidToStringW

wininet

InternetErrorDlg HttpEndRequestW HttpQueryInfoW InternetGetLastResponseInfoW InternetReadFileExA HttpAddRequestHeadersW HttpOpenRequestW InternetConnectW InternetSetStatusCallbackW InternetOpenW InternetSetOptionW InternetQueryOptionW InternetOpenA InternetSetOptionA InternetCloseHandle HttpEndRequestA HttpSendRequestExA HttpAddRequestHeadersA HttpOpenRequestA InternetConnectA InternetWriteFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-08_540dd79436a1be922a380047ea47107e_elex_floxif_mafia_stealc

PE Signature issue

version

ws2_32

userenv

imm32

wtsapi32

psapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

iphlpapi

rpcrt4

wininet

generic