clop | 2026-03-13_e57f9672fa77cb12054abf8d554f3a7d_clop_elex_remcos_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-03-13_e57f9672fa77cb12054abf8d554f3a7d_clop_elex_remcos_rhadamanthys_stop
Size 248KB
Sample260313-edk86sbs9q
SHA256 562f867ad5f218da87156af2cf38621e8fbbd21098c97a5f4d2158d284e6e208
MD5 e57f9672fa77cb12054abf8d554f3a7d
SHA1 73e17012a6f9a0999fc304f1fbc0577a88588fbf
SHA512 b0e9b9b8105dd50eaf70d13e6c8cefb012013a28dc65e6615eaefb69e09bcb724c613b699fd53ad6c1ccd17a8feed5a9b0ac578b823c46cab7fad023352a03a2
SSDEEP 3072:ee+AWHmhCmRcjx2Sc1dbA3CtFowxHPnEH7g4UBbVYgIrtHtSB6K7nnoWbW+FWj:ee9hKU0qVJnEH7gfBJJ8RtSB60n
TLSH
T187447C10B9D1D432D1B219316874D6A69ABEBD301A125E9B7F940F3EDF302C1EA31B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clop

Malware Config

Signatures

Clop family
clop

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-13_e57f9672fa77cb12054abf8d554f3a7d_clop_elex_remcos_rhadamanthys_stop

File Explorer

2026-03-13_e57f9672fa77cb12054abf8d554f3a7d_clop_elex_remcos_rhadamanthys_stop

.exe 248KB

2026-03-13_e57f9672fa77cb12054abf8d554f3a7d_clop_elex_remcos_rhadamanthys_stop

IMPHASH f33c7aaba5188ab257bafef74b9ebf68
SHA256 562f867ad5f218da87156af2cf38621e8fbbd21098c97a5f4d2158d284e6e208
MD5 e57f9672fa77cb12054abf8d554f3a7d
SHA1 73e17012a6f9a0999fc304f1fbc0577a88588fbf
SHA512 b0e9b9b8105dd50eaf70d13e6c8cefb012013a28dc65e6615eaefb69e09bcb724c613b699fd53ad6c1ccd17a8feed5a9b0ac578b823c46cab7fad023352a03a2
SSDEEP 3072:ee+AWHmhCmRcjx2Sc1dbA3CtFowxHPnEH7g4UBbVYgIrtHtSB6K7nnoWbW+FWj:ee9hKU0qVJnEH7gfBJJ8RtSB60n
TLSH
T187447C10B9D1D432D1B219316874D6A69ABEBD301A125E9B7F940F3EDF302C1EA31B5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4663

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcpyA GlobalFree CloseHandle CreateThread MoveFileExW lstrcpyW CreateFileMappingW MapViewOfFile lstrcmpW GetShortPathNameA GetModuleFileNameA BeginUpdateResourceA EraseTape FindFirstVolumeW GetProfileSectionW GetCurrentProcess lstrlenW CancelDeviceWakeupRequest TerminateProcess GlobalUnWire GetConsoleTitleW EnumResourceNamesW CreateMutexW OpenFile GetEnvironmentVariableA EnumSystemCodePagesW CancelThreadpoolIo GlobalDeleteAtom QueryMemoryResourceNotification GetACP OpenProcess FindFirstVolumeMountPointA FindActCtxSectionStringA CreateToolhelp32Snapshot CreateEventW Sleep GetLastError GetConsoleAliasesLengthW Process32NextW CreateFileA SetEvent DefineDosDeviceA DeleteFileW GetCurrentThread GetSystemDirectoryA Process32FirstW GlobalFindAtomW QueueUserAPC LocalSize FindAtomA ExitProcess FreeLibrary GetSystemTime GlobalUnlock GetDriveTypeW FindFirstFileTransactedA CreateTimerQueue SizeofResource GetCurrentDirectoryA LockResource LoadResource FindResourceW GetModuleHandleW DecodePointer WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap GetStringTypeW GlobalAlloc ReadFile lstrcatW GetFileType SetStdHandle OutputDebugStringW SetFileAttributesW UnmapViewOfFile CreateFileW WaitForSingleObject FindClose lstrlenA SetFilePointer SetErrorMode VirtualAlloc LCMapStringW WriteFile FindNextFileW VirtualFree FindFirstFileW GetSystemFileCacheSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress LoadLibraryExW GetStdHandle MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW HeapFree HeapAlloc FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException

user32

GetWindowTextW wsprintfW GetDC EqualRect wsprintfA DestroyIcon GetKeyboardLayout EnumWindows CharUpperBuffW GetDesktopWindow GetLastActivePopup

gdi32

CreateDIBPatternBrush GetTextCharset

winspool.drv

OpenPrinterA

advapi32

RegisterServiceCtrlHandlerW CryptGenKey CryptExportKey CryptEncrypt CryptAcquireContextW SetServiceStatus CryptReleaseContext StartServiceCtrlDispatcherW CryptDestroyKey

shell32

SHGetSpecialFolderPathW ShellExecuteA

shlwapi

StrStrW

crypt32

CryptStringToBinaryA CryptImportPublicKeyInfoEx CryptDecodeObjectEx

mpr

WNetOpenEnumW WNetEnumResourceW WNetCloseEnum