2026-06-01_28575492516fd2f5ccfb04ca4534b750_elex_maze_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-01_28575492516fd2f5ccfb04ca4534b750_elex_maze_remcos
Size 402KB
Sample260601-bcf2aaax3s
SHA256 36fde08d73476b6989d32effd205a15f6b0d50a9e6e1b7bcdc8db6a0c43105fd
MD5 28575492516fd2f5ccfb04ca4534b750
SHA1 7a107d186260cf6d0aeb41d9abc9367bf985ee82
SHA512 ba1d3b3dd310691563ff098488f9d2c9e8e5cf8f833779d734e96fb51efa271bb1edd98e5431d9d4ba8474555e1242e474cf6592c9951915c1e8f5e576267286
SSDEEP 12288:J9H01AyeCusoU8a2AFarW+T/fT391TuFAv2G:Jp01AyeCuS8bxT39UFnG
TLSH
T179947C00BB81D135E4B202729BB9AB29157DB9750F72C6CBF3C8195E1D706C26B33B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-06-01_28575492516fd2f5ccfb04ca4534b750_elex_maze_remcos

File Explorer

2026-06-01_28575492516fd2f5ccfb04ca4534b750_elex_maze_remcos

.exe 402KB

2026-06-01_28575492516fd2f5ccfb04ca4534b750_elex_maze_remcos

IMPHASH 64c6a5cb7b36b70a2b4fa43bbf553ae7
SHA256 36fde08d73476b6989d32effd205a15f6b0d50a9e6e1b7bcdc8db6a0c43105fd
MD5 28575492516fd2f5ccfb04ca4534b750
SHA1 7a107d186260cf6d0aeb41d9abc9367bf985ee82
SHA512 ba1d3b3dd310691563ff098488f9d2c9e8e5cf8f833779d734e96fb51efa271bb1edd98e5431d9d4ba8474555e1242e474cf6592c9951915c1e8f5e576267286
SSDEEP 12288:J9H01AyeCusoU8a2AFarW+T/fT391TuFAv2G:Jp01AyeCuS8bxT39UFnG
TLSH
T179947C00BB81D135E4B202729BB9AB29157DB9750F72C6CBF3C8195E1D706C26B33B66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c4:c1:bb:44:e4:b6:7a:b5:a2:7e:77:80:aa:e3:db:18:12:e8:aa:cd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Nov 17, 2015

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 7, 2012 - Jun 6, 2022

Subject

Serial Number

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 14, 2014 - Jan 7, 2016

Minor OS version

Major OS version

Entry point

134982

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\builds\ACC\GM\source\dev\target\win32\Release\HDCore\Setup.pdb

kernel32

GetLastError AttachConsole DecodePointer DeleteCriticalSection OutputDebugStringW WaitForSingleObject WriteFile InitializeCriticalSection Sleep LeaveCriticalSection ReadFile CreateFileW EnterCriticalSection CloseHandle CreateThread WideCharToMultiByte MultiByteToWideChar FindFirstFileW SetFilePointer lstrcmpW GetTempPathW FindNextFileW GetCurrentThreadId DeleteFileW GetDateFormatW SystemTimeToFileTime GetTimeFormatW FileTimeToSystemTime GetFileSizeEx GetLocalTime CreateMutexW OpenMutexW ReleaseMutex InitializeCriticalSectionAndSpinCount LocalFree MoveFileExW GetModuleFileNameW FlushFileBuffers GetStdHandle FreeLibrary LoadLibraryW GetProcAddress lstrlenA GetUserDefaultLCID LCMapStringW SetEvent ResetEvent CreateEventW HeapReAlloc HeapAlloc GetCurrentProcess HeapFree GetModuleHandleW GetProcessHeap TerminateProcess HeapSize GetFileType TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo RaiseException InitializeCriticalSectionEx GetConsoleWindow FreeConsole SetDllDirectoryW RtlUnwind GetConsoleMode ReadConsoleW CompareStringW SetStdHandle EncodePointer GetLocaleInfoW GetOEMCP GetACP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SetEnvironmentVariableA SetEndOfFile WriteConsoleW GetConsoleCP LoadLibraryExW GetStringTypeW SetFilePointerEx EnumSystemLocalesW IsValidLocale GetSystemTimeAsFileTime GetTimeZoneInformation IsDebuggerPresent IsProcessorFeaturePresent SetLastError ExitProcess GetModuleHandleExW GetCommandLineW

user32

wsprintfW SendMessageW

shell32

SHCreateDirectoryExW SHGetFolderPathW SHGetPathFromIDListW SHGetFolderLocation SHGetSpecialFolderPathW

ole32

CoCreateInstance CoTaskMemFree CLSIDFromProgID CoInitialize CoUninitialize CLSIDFromString OleRun

oleaut32

SysFreeString VariantChangeType VariantInit VariantCopy VariantClear SysAllocString GetErrorInfo

shlwapi

PathFindFileNameW PathIsFileSpecW PathRemoveFileSpecW PathRemoveExtensionW PathFileExistsW PathAddExtensionW PathAppendW PathRenameExtensionW PathIsDirectoryW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-01_28575492516fd2f5ccfb04ca4534b750_elex_maze_remcos

PE Signature issue

kernel32

user32

shell32

ole32

oleaut32

shlwapi

generic