clop | 2026-03-11_b3356a7c6b210e064f7b56df2e363e0b_clop_elex_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-03-11_b3356a7c6b210e064f7b56df2e363e0b_clop_elex_remcos
Size 328KB
Sample260311-b3dnvaew8j
SHA256 0e8c37c81a4fed100a275d65c1a5865719e089d4fc483bbc0092637ed7865539
MD5 b3356a7c6b210e064f7b56df2e363e0b
SHA1 4d57d7a5778b85dafa53dc95b70e1c188882dbaa
SHA512 abc41159c561d3cd0d3e3367377bfbcc3194bbf4de73a4e83a362a6e5643f1f08efd803fe1d0c48761a5304a79e4adb5af5b27acd2208fc2f7fdaca0039335db
SSDEEP 6144:Eg81wVrQWWxbuoOLdBUSsDoE7J+GkWjfwtZ6YojD0JYlLxMuQMmoc:dTWcfBUb17wbWU76h3SYUuQMm7
TLSH
T15B647B0AD7E1946AFCB38972173897A1C53D77313A0481FB2259B93D6EB46D2DC22B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clop

Malware Config

Signatures

Clop family
clop

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-11_b3356a7c6b210e064f7b56df2e363e0b_clop_elex_remcos

File Explorer

2026-03-11_b3356a7c6b210e064f7b56df2e363e0b_clop_elex_remcos

.exe 328KB

2026-03-11_b3356a7c6b210e064f7b56df2e363e0b_clop_elex_remcos

IMPHASH 069a8731477fdc061b4309f9885b63af
SHA256 0e8c37c81a4fed100a275d65c1a5865719e089d4fc483bbc0092637ed7865539
MD5 b3356a7c6b210e064f7b56df2e363e0b
SHA1 4d57d7a5778b85dafa53dc95b70e1c188882dbaa
SHA512 abc41159c561d3cd0d3e3367377bfbcc3194bbf4de73a4e83a362a6e5643f1f08efd803fe1d0c48761a5304a79e4adb5af5b27acd2208fc2f7fdaca0039335db
SSDEEP 6144:Eg81wVrQWWxbuoOLdBUSsDoE7J+GkWjfwtZ6YojD0JYlLxMuQMmoc:dTWcfBUb17wbWU76h3SYUuQMm7
TLSH
T15B647B0AD7E1946AFCB38972173897A1C53D77313A0481FB2259B93D6EB46D2DC22B13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

214061

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindCloseChangeNotification GetDriveTypeW GetFileAttributesExW LocalFileTimeToFileTime LockFileEx WriteFileGather FindFirstFileNameW WaitForDebugEvent DecodeSystemPointer Beep FatalAppExitW FlsAlloc HeapCreate HeapAlloc HeapFree GetProcessHeap GetProcessHeaps CreateIoCompletionPort InitializeSRWLock InitializeCriticalSection DeleteCriticalSection InitOnceExecuteOnce InitOnceComplete SetEvent ReleaseSemaphore CreateMutexA CreateEventW Sleep SignalObjectAndWait GetProcessTimes GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess OpenThread GetProcessVersion SetPriorityClass OpenProcess GetSystemTimes GetTickCount64 GetSystemTimeAdjustment VirtualAllocEx VirtualUnlock DisableThreadLibraryCalls GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress FindResourceW GlobalSize GlobalFlags GlobalUnfix LocalUnlock LocalSize LocalFree SwitchToFiber GlobalDeleteAtom ClearCommError FormatMessageA SearchPathA lstrcmpiW lstrlenA MapViewOfFile EndUpdateResourceW GetProfileSectionW GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringW WritePrivateProfileStructA CreateFileTransactedW GetCompressedFileSizeTransactedW CreateHardLinkTransactedW FindFirstFileNameTransactedW GetNamedPipeServerProcessId FileTimeToSystemTime GetTimeZoneInformation GetTimeFormatW GetStringTypeW GetACP IsValidLanguageGroup GetGeoInfoW GetThreadLocale GetUserPreferredUILanguages EnumLanguageGroupLocalesA EnumSystemCodePagesW GetCurrencyFormatEx LCMapStringEx EnumTimeFormatsEx WriteConsoleOutputCharacterA FillConsoleOutputCharacterA GetConsoleTitleW GetConsoleAliasesLengthA CreateToolhelp32Snapshot Process32FirstW Process32NextW LoadResource LockResource SizeofResource WriteConsoleW DecodePointer SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize LCMapStringW GetFileType SetStdHandle lstrlenW lstrcatW lstrcpyW lstrcpyA GlobalFree GlobalUnlock GlobalLock GlobalAlloc CreateMailslotW UnmapViewOfFile CreateFileMappingW VirtualFree VirtualAlloc GetTickCount ExitThread CreateThread WaitForSingleObject SetErrorMode GetLastError CloseHandle WriteFile SetFilePointer SetFileAttributesW ReadFile FindNextFileW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP FindFirstFileW FindClose FindResourceExA CreateFileW IsValidCodePage FindFirstFileExW GetModuleHandleExW WideCharToMultiByte MultiByteToWideChar GetStdHandle RaiseException LoadLibraryExW FreeLibrary UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

TranslateMessage CharUpperW wsprintfW GetClassNameW IsDlgButtonChecked GetNextDlgTabItem CallMsgFilterW EnumClipboardFormats TranslateMDISysAccel DefMDIChildProcW DestroyIcon GetMessageW FindWindowW UnionRect GetSysColor GrayStringW DestroyMenu CharUpperBuffW GetClipboardFormatNameW

gdi32

ResizePalette PaintRgn IntersectClipRect GetRgnBox GetPolyFillMode ExtFloodFill DeleteMetaFile CreateRectRgnIndirect CreatePolygonRgn

advapi32

RegQueryValueExA CreateProcessAsUserW OpenProcessToken SetServiceStatus RegisterServiceCtrlHandlerW CryptAcquireContextW RegUnLoadKeyA RegRestoreKeyA CryptEncrypt RegLoadKeyA LookupAccountSidW RevertToSelf GetTokenInformation DuplicateTokenEx

mpr

WNetOpenEnumW WNetCloseEnum WNetEnumResourceW

shlwapi

StrStrW PathFindFileNameW

crypt32

CryptImportPublicKeyInfo CryptDecodeObjectEx CryptStringToBinaryA

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

rstrtmgr

RmGetList RmStartSession RmShutdown RmRestart RmEndSession RmRegisterResources