clop | 2026-03-10_64ebbb6613db7e3f7f7694796d8eff8d_clop_elex_remcos_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-03-10_64ebbb6613db7e3f7f7694796d8eff8d_clop_elex_remcos_rhadamanthys_stop
Size 248KB
Sample260310-d4jmlacz8m
SHA256 432a4abf4938ef7b769b210fa73f534ed3dd1e74df61c6c2efb55db53f2d916c
MD5 64ebbb6613db7e3f7f7694796d8eff8d
SHA1 99069f3d0f6504714a8b67c0cdce31093f6e69b9
SHA512 a9163f3f71d94b791c4caf4db49b062a1f53bdc6918debeabb97436f4ae6d81945d5df9d77f0ac1ac59370bd69c9f8f4234f59b506d3eabb5ac1a5aca564e3de
SSDEEP 3072:ee+AWHmhCmRcjx2Sc1DbA3CtFuwxHPnEH7g4UBbVYgIrtHtSB6K7nnoWbW+FWj:ee9hKU2q/JnEH7gfBJJ8RtSB60n
TLSH
T160447C10B9D1D432D1B219316874D6A69ABEBD301A125E9B7F940F3EDF302C1EA31B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clop

Malware Config

Signatures

Clop family
clop

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-10_64ebbb6613db7e3f7f7694796d8eff8d_clop_elex_remcos_rhadamanthys_stop

File Explorer

2026-03-10_64ebbb6613db7e3f7f7694796d8eff8d_clop_elex_remcos_rhadamanthys_stop

.exe 248KB

2026-03-10_64ebbb6613db7e3f7f7694796d8eff8d_clop_elex_remcos_rhadamanthys_stop

IMPHASH f33c7aaba5188ab257bafef74b9ebf68
SHA256 432a4abf4938ef7b769b210fa73f534ed3dd1e74df61c6c2efb55db53f2d916c
MD5 64ebbb6613db7e3f7f7694796d8eff8d
SHA1 99069f3d0f6504714a8b67c0cdce31093f6e69b9
SHA512 a9163f3f71d94b791c4caf4db49b062a1f53bdc6918debeabb97436f4ae6d81945d5df9d77f0ac1ac59370bd69c9f8f4234f59b506d3eabb5ac1a5aca564e3de
SSDEEP 3072:ee+AWHmhCmRcjx2Sc1DbA3CtFuwxHPnEH7g4UBbVYgIrtHtSB6K7nnoWbW+FWj:ee9hKU2q/JnEH7gfBJJ8RtSB60n
TLSH
T160447C10B9D1D432D1B219316874D6A69ABEBD301A125E9B7F940F3EDF302C1EA31B5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4663

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcpyA GlobalFree CloseHandle CreateThread MoveFileExW lstrcpyW CreateFileMappingW MapViewOfFile lstrcmpW GetShortPathNameA GetModuleFileNameA BeginUpdateResourceA EraseTape FindFirstVolumeW GetProfileSectionW GetCurrentProcess lstrlenW CancelDeviceWakeupRequest TerminateProcess GlobalUnWire GetConsoleTitleW EnumResourceNamesW CreateMutexW OpenFile GetEnvironmentVariableA EnumSystemCodePagesW CancelThreadpoolIo GlobalDeleteAtom QueryMemoryResourceNotification GetACP OpenProcess FindFirstVolumeMountPointA FindActCtxSectionStringA CreateToolhelp32Snapshot CreateEventW Sleep GetLastError GetConsoleAliasesLengthW Process32NextW CreateFileA SetEvent DefineDosDeviceA DeleteFileW GetCurrentThread GetSystemDirectoryA Process32FirstW GlobalFindAtomW QueueUserAPC LocalSize FindAtomA ExitProcess FreeLibrary GetSystemTime GlobalUnlock GetDriveTypeW FindFirstFileTransactedA CreateTimerQueue SizeofResource GetCurrentDirectoryA LockResource LoadResource FindResourceW GetModuleHandleW DecodePointer WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap GetStringTypeW GlobalAlloc ReadFile lstrcatW GetFileType SetStdHandle OutputDebugStringW SetFileAttributesW UnmapViewOfFile CreateFileW WaitForSingleObject FindClose lstrlenA SetFilePointer SetErrorMode VirtualAlloc LCMapStringW WriteFile FindNextFileW VirtualFree FindFirstFileW GetSystemFileCacheSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress LoadLibraryExW GetStdHandle MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW HeapFree HeapAlloc FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException

user32

GetWindowTextW wsprintfW GetDC EqualRect wsprintfA DestroyIcon GetKeyboardLayout EnumWindows CharUpperBuffW GetDesktopWindow GetLastActivePopup

gdi32

CreateDIBPatternBrush GetTextCharset

winspool.drv

OpenPrinterA

advapi32

RegisterServiceCtrlHandlerW CryptGenKey CryptExportKey CryptEncrypt CryptAcquireContextW SetServiceStatus CryptReleaseContext StartServiceCtrlDispatcherW CryptDestroyKey

shell32

SHGetSpecialFolderPathW ShellExecuteA

shlwapi

StrStrW

crypt32

CryptStringToBinaryA CryptImportPublicKeyInfoEx CryptDecodeObjectEx

mpr

WNetOpenEnumW WNetEnumResourceW WNetCloseEnum