2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc

General

Target
2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc
Size 416KB
Sample260423-sn6jragz21
SHA256 9d4f674a30bf7a70de95fd25e86cfbafd31e132e430028c86c277f0790f732a9
MD5 907996a80f9390c26cd161802591976c
SHA1 445b8e7e3cd9cbb99d83cea6de1c223de0115951
SHA512 4905d39ea36d78ddf332551b7d26d19829ee31d9834591e321876e8027e7aa2ed9f9e456660691d3848db7dcda397491f1633abed64607e228309456e83c0438
SSDEEP 6144:HJSidiqUYMmKwvG7gkDGTXQ3M3QdGmnnhWSI/IjK0Dsml7CyRF:HJ3di6MmKlqTXQc3nEhWSIiKol+2F
TLSH
T10C945B007493C035D5B395F5CDB9A36245BCAA622BB499C3BFD8484D4AB84E1EB7231F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc

File Explorer

2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc

.exe 416KB

2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc

IMPHASH a937ee21afc8da8c636807fc65975a17
SHA256 9d4f674a30bf7a70de95fd25e86cfbafd31e132e430028c86c277f0790f732a9
MD5 907996a80f9390c26cd161802591976c
SHA1 445b8e7e3cd9cbb99d83cea6de1c223de0115951
SHA512 4905d39ea36d78ddf332551b7d26d19829ee31d9834591e321876e8027e7aa2ed9f9e456660691d3848db7dcda397491f1633abed64607e228309456e83c0438
SSDEEP 6144:HJSidiqUYMmKwvG7gkDGTXQ3M3QdGmnnhWSI/IjK0Dsml7CyRF:HJ3di6MmKlqTXQc3nEhWSIiKol+2F
TLSH
T10C945B007493C035D5B395F5CDB9A36245BCAA622BB499C3BFD8484D4AB84E1EB7231F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

176916

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess CreateThread GetModuleHandleA GetProcAddress EncodePointer DecodePointer GetLastError ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc GetSystemTimeAsFileTime GetCommandLineA RaiseException RtlUnwind IsProcessorFeaturePresent HeapSize IsDebuggerPresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FatalAppExitA UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetTickCount GetModuleHandleW CreateSemaphoreW GetStdHandle WriteFile GetModuleFileNameW SetConsoleCtrlHandler FreeLibrary LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThread GetCurrentThreadId GetProcessHeap FindClose FindFirstFileExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CloseHandle FlushFileBuffers GetConsoleCP GetConsoleMode GetFileType GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc OutputDebugStringW GetStringTypeW FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetFullPathNameW SetCurrentDirectoryW GetCurrentDirectoryW CreateFileW SetStdHandle SetFilePointerEx WriteConsoleW GetTimeZoneInformation SetEndOfFile ReadFile ReadConsoleW GetFullPathNameA SetEnvironmentVariableA

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-23_907996a80f9390c26cd161802591976c_elex_hawkeye_maze_remcos_stealc

kernel32

generic