clop | 2026-03-13_ee03b9c339fb7ed8682afb552e58ae8d_clop_elex_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-03-13_ee03b9c339fb7ed8682afb552e58ae8d_clop_elex_remcos
Size 112KB
Sample260313-eeah3abs9r
SHA256 23f3a0db4f26ea58fbb03a03a2eff9a64d3e64fd60f035c8c047984b3fb89257
MD5 ee03b9c339fb7ed8682afb552e58ae8d
SHA1 17ccf3d17cfaa919ce0330a40cb79a3a88c222da
SHA512 dc789f7d665d584a066fdc9b7a5034b3aeea1df56218513596fc88e3853782416f52c7cf65928c5f3c78628c496dfb22379bced692ce5a1cdf5f32b5f3b86f43
SSDEEP 3072:Me+AWHmhCmRcjx2ScadbA3CtFmRwxHPnEH7:Me9hKUFq8KJnEH7
TLSH
T134B33B00B5D19470E1765E3268B4AB929ABFFD711B264FDB7F44021E8E351C0BA32DB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clop

Malware Config

Signatures

Clop family
clop

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-13_ee03b9c339fb7ed8682afb552e58ae8d_clop_elex_remcos

File Explorer

2026-03-13_ee03b9c339fb7ed8682afb552e58ae8d_clop_elex_remcos

.exe 112KB

2026-03-13_ee03b9c339fb7ed8682afb552e58ae8d_clop_elex_remcos

IMPHASH f33c7aaba5188ab257bafef74b9ebf68
SHA256 23f3a0db4f26ea58fbb03a03a2eff9a64d3e64fd60f035c8c047984b3fb89257
MD5 ee03b9c339fb7ed8682afb552e58ae8d
SHA1 17ccf3d17cfaa919ce0330a40cb79a3a88c222da
SHA512 dc789f7d665d584a066fdc9b7a5034b3aeea1df56218513596fc88e3853782416f52c7cf65928c5f3c78628c496dfb22379bced692ce5a1cdf5f32b5f3b86f43
SSDEEP 3072:Me+AWHmhCmRcjx2ScadbA3CtFmRwxHPnEH7:Me9hKUFq8KJnEH7
TLSH
T134B33B00B5D19470E1765E3268B4AB929ABFFD711B264FDB7F44021E8E351C0BA32DB6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4663

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcpyA GlobalFree CloseHandle CreateThread MoveFileExW lstrcpyW CreateFileMappingW MapViewOfFile lstrcmpW GetShortPathNameA GetModuleFileNameA BeginUpdateResourceA EraseTape FindFirstVolumeW GetProfileSectionW GetCurrentProcess lstrlenW CancelDeviceWakeupRequest TerminateProcess GlobalUnWire GetConsoleTitleW EnumResourceNamesW CreateMutexW OpenFile GetEnvironmentVariableA EnumSystemCodePagesW CancelThreadpoolIo GlobalDeleteAtom QueryMemoryResourceNotification GetACP OpenProcess FindFirstVolumeMountPointA FindActCtxSectionStringA CreateToolhelp32Snapshot CreateEventW Sleep GetLastError GetConsoleAliasesLengthW Process32NextW CreateFileA SetEvent DefineDosDeviceA DeleteFileW GetCurrentThread GetSystemDirectoryA Process32FirstW GlobalFindAtomW QueueUserAPC LocalSize FindAtomA ExitProcess FreeLibrary GetSystemTime GlobalUnlock GetDriveTypeW FindFirstFileTransactedA CreateTimerQueue SizeofResource GetCurrentDirectoryA LockResource LoadResource FindResourceW GetModuleHandleW DecodePointer WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap GetStringTypeW GlobalAlloc ReadFile lstrcatW GetFileType SetStdHandle OutputDebugStringW SetFileAttributesW UnmapViewOfFile CreateFileW WaitForSingleObject FindClose lstrlenA SetFilePointer SetErrorMode VirtualAlloc LCMapStringW WriteFile FindNextFileW VirtualFree FindFirstFileW GetSystemFileCacheSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress LoadLibraryExW GetStdHandle MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW HeapFree HeapAlloc FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException

user32

GetWindowTextW wsprintfW GetDC EqualRect wsprintfA DestroyIcon GetKeyboardLayout EnumWindows CharUpperBuffW GetDesktopWindow GetLastActivePopup

gdi32

CreateDIBPatternBrush GetTextCharset

winspool.drv

OpenPrinterA

advapi32

RegisterServiceCtrlHandlerW CryptGenKey CryptExportKey CryptEncrypt CryptAcquireContextW SetServiceStatus CryptReleaseContext StartServiceCtrlDispatcherW CryptDestroyKey

shell32

SHGetSpecialFolderPathW ShellExecuteA

shlwapi

StrStrW

crypt32

CryptStringToBinaryA CryptImportPublicKeyInfoEx CryptDecodeObjectEx

mpr

WNetOpenEnumW WNetEnumResourceW WNetCloseEnum