Suspicious ^80% Download

2026-09-26_d5f95fc02c0d0ff3b1ac09fd2a23199e_elex_mafia_stealc_tofsee

Elex trojan masquerading as Word

Unsigned PE claims WinWord version identityPE masquerades as Microsoft Office in version metadata

SHA-25680990f3c2683a72c23867187052ed701b2ea6d54965b47b3268ade14a9837879

URLhttps://tria.ge/api/v0/samples/260926-rgc37avdrf/sample

MaleculeK(Mc)O₅(Er₆As₇C₂PPr)H₈(CmCrDb₅F₄Os₁₀Po₉TiU)Md₆(Bi₁₂HePaPtSi)Th

Evidence

Small code section in large PE 0x3c0–0x650

⋯3 more rows
0x3f000000000000000000000000000000000................
0x400558bec6afe68a8874200685073410064U..j.h..B.hPsA.d
0x410a1000000005083ec10535657a120b542.....P...SVW. .B
0x420003145f833c5508d45f064a300000000.1E.3.P.E.d.....
⋯35 more rows

x86 indirect call through a global pointer 0x93ff–0x94bf

⋯3 more rows
0x942fde0f849a0000008d45e85056568975e8........E.PVV.u.
0x943f8b353cc6460053ffd68b45e833c93bc1.5<.F.S...E.3.;.
0x944f746b894dcc894dd0894dd450c645fc02tk.M..M..M.P.E..
⋯7 more rows

x86 CREATE_NO_WINDOW stack argument 0xc076–0xc136

⋯3 more rows
0xc0a68d959c7affff528d85587affff505353...z..R..Xz..PSS
0xc0b668000000085353538d8d0c7bffff518dh....SSS...{..Q.
0xc0c69514fdffff52ff1590404200895dfceb.....R...@B..]..
⋯7 more rows

Microsoft Office Word version string 0x751f6–0x75476

0x751f6000001002000a8250000080020200000.... ..%....  ..
0x7520601002000a81000000900101000000100.. .............
0x752162000680400000a005041a40434000000 .h.....PA..4...
0x75226560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x752364f004e005f0049004e0046004f000000O.N._.I.N.F.O...
⋯6 more rows
0x752a6300030003000300030003400450034000.0.0.0.0.4.E.4.
0x752b600004c001600010043006f006d007000..L.....C.o.m.p.
0x752c661006e0079004e0061006d0065000000a.n.y.N.a.m.e...
0x752d600004d006900630072006f0073006f00..M.i.c.r.o.s.o.
0x752e666007400200043006f00720070006f00f.t. .C.o.r.p.o.
0x752f672006100740069006f006e0000005400r.a.t.i.o.n...T.
0x7530616000100460069006c00650044006500....F.i.l.e.D.e.
0x7531673006300720069007000740069006f00s.c.r.i.p.t.i.o.
0x753266e00000000004d006900630072006f00n.....M.i.c.r.o.
0x7533673006f006600740020004f0066006600s.o.f.t. .O.f.f.
0x75346690063006500200057006f0072006400i.c.e. .W.o.r.d.
0x7535600003e000f000100460069006c006500..>.....F.i.l.e.
0x75366560065007200730069006f006e000000V.e.r.s.i.o.n...
0x753760000310032002e0030002e0034003500..1.2...0...4.5.
0x75386310038002e00310030003100340000001.8...1.0.1.4...
0x75396000030000800010049006e0074006500..0.....I.n.t.e.
0x753a672006e0061006c004e0061006d006500r.n.a.l.N.a.m.e.
0x753b60000570069006e0057006f0072006400..W.i.n.W.o.r.d.
0x753c600008c00340001004c00650067006100....4...L.e.g.a.
⋯11 more rows

Claims to be Microsoft Office product 0x75504–0x756d4

⋯9 more rows
0x7559469006f006e002e000000000040000c00i.o.n.......@...
0x755a401004f0072006900670069006e006100..O.r.i.g.i.n.a.
0x755b46c00460069006c0065006e0061006d00l.F.i.l.e.n.a.m.
0x755c465000000570069006e0057006f007200e...W.i.n.W.o.r.
0x755d464002e0065007800650000005a001d00d...e.x.e...Z...
0x755e40100500072006f006400750063007400..P.r.o.d.u.c.t.
0x755f44e0061006d0065000000000032003000N.a.m.e.....2.0.
0x756043000370020004d006900630072006f000.7. .M.i.c.r.o.
0x7561473006f006600740020004f0066006600s.o.f.t. .O.f.f.
0x7562469006300650020007300790073007400i.c.e. .s.y.s.t.
0x7563465006d000000000042000f0001005000e.m.....B.....P.
0x7564472006f00640075006300740056006500r.o.d.u.c.t.V.e.
0x756547200730069006f006e00000031003200r.s.i.o.n...1.2.
⋯8 more rows