clop | 2026-03-13_bb09c88a64fc8bba8bc9f8fec6b02d56_clop_elex_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-03-13_bb09c88a64fc8bba8bc9f8fec6b02d56_clop_elex_remcos
Size 112KB
Sample260313-d93yesbs7m
SHA256 a1835a2abd7210519f1d8da9f33dacc39fb4f38f39738ebaf8740409ee4dfb2e
MD5 bb09c88a64fc8bba8bc9f8fec6b02d56
SHA1 b4872ca67c19c54dc060ae6d2e440626bc1304a2
SHA512 d50e90a91547b97c3308921a76c25337e890bf90c9f64668bf3a6965cbf6286b925d7ceab2197aa3ec138c92e1ef18007bb077f2973d4eb8b3e79fbe6408fcbd
SSDEEP 3072:Se+AWHmhCmRcjx2ScaDbA3CGFmVwxHPnEH7:Se9hKUL18mJnEH7
TLSH
T156B33B00B5D19470E5765E3268B0AB929ABFFD711B264FDB7F44021E8E351C0BA32DB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clop

Malware Config

Signatures

Clop family
clop

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-13_bb09c88a64fc8bba8bc9f8fec6b02d56_clop_elex_remcos

File Explorer

2026-03-13_bb09c88a64fc8bba8bc9f8fec6b02d56_clop_elex_remcos

.exe 112KB

2026-03-13_bb09c88a64fc8bba8bc9f8fec6b02d56_clop_elex_remcos

IMPHASH f33c7aaba5188ab257bafef74b9ebf68
SHA256 a1835a2abd7210519f1d8da9f33dacc39fb4f38f39738ebaf8740409ee4dfb2e
MD5 bb09c88a64fc8bba8bc9f8fec6b02d56
SHA1 b4872ca67c19c54dc060ae6d2e440626bc1304a2
SHA512 d50e90a91547b97c3308921a76c25337e890bf90c9f64668bf3a6965cbf6286b925d7ceab2197aa3ec138c92e1ef18007bb077f2973d4eb8b3e79fbe6408fcbd
SSDEEP 3072:Se+AWHmhCmRcjx2ScaDbA3CGFmVwxHPnEH7:Se9hKUL18mJnEH7
TLSH
T156B33B00B5D19470E5765E3268B0AB929ABFFD711B264FDB7F44021E8E351C0BA32DB6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4663

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcpyA GlobalFree CloseHandle CreateThread MoveFileExW lstrcpyW CreateFileMappingW MapViewOfFile lstrcmpW GetShortPathNameA GetModuleFileNameA BeginUpdateResourceA EraseTape FindFirstVolumeW GetProfileSectionW GetCurrentProcess lstrlenW CancelDeviceWakeupRequest TerminateProcess GlobalUnWire GetConsoleTitleW EnumResourceNamesW CreateMutexW OpenFile GetEnvironmentVariableA EnumSystemCodePagesW CancelThreadpoolIo GlobalDeleteAtom QueryMemoryResourceNotification GetACP OpenProcess FindFirstVolumeMountPointA FindActCtxSectionStringA CreateToolhelp32Snapshot CreateEventW Sleep GetLastError GetConsoleAliasesLengthW Process32NextW CreateFileA SetEvent DefineDosDeviceA DeleteFileW GetCurrentThread GetSystemDirectoryA Process32FirstW GlobalFindAtomW QueueUserAPC LocalSize FindAtomA ExitProcess FreeLibrary GetSystemTime GlobalUnlock GetDriveTypeW FindFirstFileTransactedA CreateTimerQueue SizeofResource GetCurrentDirectoryA LockResource LoadResource FindResourceW GetModuleHandleW DecodePointer WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap GetStringTypeW GlobalAlloc ReadFile lstrcatW GetFileType SetStdHandle OutputDebugStringW SetFileAttributesW UnmapViewOfFile CreateFileW WaitForSingleObject FindClose lstrlenA SetFilePointer SetErrorMode VirtualAlloc LCMapStringW WriteFile FindNextFileW VirtualFree FindFirstFileW GetSystemFileCacheSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress LoadLibraryExW GetStdHandle MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW HeapFree HeapAlloc FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException

user32

GetWindowTextW wsprintfW GetDC EqualRect wsprintfA DestroyIcon GetKeyboardLayout EnumWindows CharUpperBuffW GetDesktopWindow GetLastActivePopup

gdi32

CreateDIBPatternBrush GetTextCharset

winspool.drv

OpenPrinterA

advapi32

RegisterServiceCtrlHandlerW CryptGenKey CryptExportKey CryptEncrypt CryptAcquireContextW SetServiceStatus CryptReleaseContext StartServiceCtrlDispatcherW CryptDestroyKey

shell32

SHGetSpecialFolderPathW ShellExecuteA

shlwapi

StrStrW

crypt32

CryptStringToBinaryA CryptImportPublicKeyInfoEx CryptDecodeObjectEx

mpr

WNetOpenEnumW WNetEnumResourceW WNetCloseEnum