2026-07-21_713388dadd0c61af0aa024c23ce4a190_elex_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-21_713388dadd0c61af0aa024c23ce4a190_elex_remcos_stop
Size 2.4MB
Sample260721-bspy5ac15t
SHA256 d164ff6433b492d71a132a2270ac699eabbae43f36ef92bce1e35d198482455d
MD5 713388dadd0c61af0aa024c23ce4a190
SHA1 01ea504c1a6a420bd4e7b07b66d51843b333ba84
SHA512 1d5932143626942564a4db777959268ec04f369f7ce5b741ff0e585f10c1fc06f953a6ece2262f50fd1bd02f1c8955f8055a5e5ad8ef0e6be35e282a377aeea9
SSDEEP 49152:M+N/lWDRSVvhbUT762oJh6xHJxbn8Jaj:My/oSYwWxbn8Jaj
TLSH
T16DC52910A641933AE8EF00B2CABD495F9626BE10172464F772CE3D5FBB715E229F1217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-21_713388dadd0c61af0aa024c23ce4a190_elex_remcos_stop

.exe 2.4MB

2026-07-21_713388dadd0c61af0aa024c23ce4a190_elex_remcos_stop

IMPHASH 66bfad9b0f3d73e37d516694043521df
SHA256 d164ff6433b492d71a132a2270ac699eabbae43f36ef92bce1e35d198482455d
MD5 713388dadd0c61af0aa024c23ce4a190
SHA1 01ea504c1a6a420bd4e7b07b66d51843b333ba84
SHA512 1d5932143626942564a4db777959268ec04f369f7ce5b741ff0e585f10c1fc06f953a6ece2262f50fd1bd02f1c8955f8055a5e5ad8ef0e6be35e282a377aeea9
SSDEEP 49152:M+N/lWDRSVvhbUT762oJh6xHJxbn8Jaj:My/oSYwWxbn8Jaj
TLSH
T16DC52910A641933AE8EF00B2CABD495F9626BE10172464F772CE3D5FBB715E229F1217
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

6c:bc:c8:bf:b0:2f:ba:ed:e4:7b:4a:ec:43:cd:eb:18:6d:86:f4:37:e1:56:51:71:d0:f9:a4:e5:58:39:ab:20

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91440400MA7FWRMCXK,CN=珠海市莫停之科技有限公司,O=珠海市莫停之科技有限公司,L=珠海市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c09e78fa0e6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 3, 2026

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

Serial Number

7b:44:70:92:7a:f6:c8:9e:3e:2c:2e:2c:d9:40:da:75

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 21, 2025 - Jan 21, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

741950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\jekins_work\workspace\potplayer_build\product\win32\dbginfo\update.pdb

kernel32

LocalFree SetLastError GetSystemTimeAsFileTime Sleep GetDiskFreeSpaceExW InterlockedIncrement GetExitCodeThread GlobalUnlock OutputDebugStringW FlushInstructionCache InterlockedExchange InterlockedDecrement GlobalLock CreatePipe GetStartupInfoW SetEnvironmentVariableW SleepEx DuplicateHandle ReleaseMutex TerminateThread FormatMessageW SetEnvironmentVariableA CompareStringW CompareStringA CreateProcessA CreateFileA GetLocaleInfoW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle FlushFileBuffers GetCurrentDirectoryA GetFullPathNameA QueryPerformanceCounter GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileW GetTimeZoneInformation GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStartupInfoA ReleaseSemaphore SetHandleCount GetModuleFileNameA GetStdHandle GetConsoleMode GetConsoleCP HeapCreate IsValidCodePage GetOEMCP ExitProcess TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleA LCMapStringW LCMapStringA GetCPInfo RtlUnwind FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetThreadLocale GetLocaleInfoA GetACP GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetVersionExA VirtualAlloc VirtualFree GetCurrentProcess GetPrivateProfileIntW SetFileAttributesW MoveFileW lstrlenA SetEvent DeleteFileW OpenEventW lstrlenW GetCurrentThreadId GetLocalTime MoveFileExW GetFileSize MultiByteToWideChar CreateProcessW CreateDirectoryW GetFileAttributesW WideCharToMultiByte GetTickCount FreeResource CreateMutexW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileTime GlobalFree GlobalAlloc SetFileTime SystemTimeToFileTime GetVersionExW GetWindowsDirectoryW GetTempPathW TerminateProcess ReadProcessMemory WritePrivateProfileStringW OutputDebugStringA RemoveDirectoryW FindClose FindNextFileW FindFirstFileW WaitForMultipleObjects RaiseException SetFilePointer SetEndOfFile ResetEvent CreateThread CreateEventW GetCurrentProcessId WaitForSingleObject WriteFile DeleteCriticalSection GetExitCodeProcess LeaveCriticalSection Process32NextW ReadFile Process32FirstW CreateToolhelp32Snapshot GetSystemDirectoryW QueryDosDeviceW GetLogicalDriveStringsW GetFileType EnterCriticalSection InitializeCriticalSection ExpandEnvironmentStringsW Module32NextW Module32FirstW OpenProcess GetPrivateProfileStringW SetErrorMode CopyFileW GetLastError FindResourceExW GetCommandLineW FreeLibrary GetProcAddress LoadLibraryW CloseHandle LockResource GetModuleHandleW LoadResource SizeofResource FindResourceW GetModuleFileNameW GetFileAttributesA

user32

SetActiveWindow IsWindow GetMonitorInfoW GetDlgItem GetWindowLongW EnableWindow SetWindowPos LoadImageW GetWindow SystemParametersInfoW GetActiveWindow SetWindowLongW PostQuitMessage CopyRect UpdateLayeredWindow IntersectRect UnregisterClassA PostMessageW RegisterWindowMessageW ExitWindowsEx FindWindowW GetForegroundWindow FindWindowExW GetWindowThreadProcessId SendMessageW GetWindowRect BringWindowToTop InvalidateRect SetForegroundWindow GetDesktopWindow DrawTextW TranslateMessage GetMessageW PostThreadMessageW DispatchMessageW PeekMessageW GetLastInputInfo IsWindowVisible EnumWindows MapWindowPoints SetRectEmpty GetFocus MoveWindow KillTimer SetCursor IsChild SetFocus IsIconic DestroyWindow GetDC ClientToScreen PtInRect IsDialogMessageW SetWindowTextW ReleaseDC GetNextDlgTabItem IsRectEmpty LoadIconW CreateWindowExW SetRect GetClassInfoExW CallWindowProcW MonitorFromWindow DefWindowProcW SetCapture IsWindowEnabled OffsetRect LoadCursorW EndPaint RegisterClassExW GetSystemMenu BeginPaint ReleaseCapture SetTimer GetClientRect DeleteMenu DestroyIcon EqualRect GetCursorPos GetDlgCtrlID DrawIconEx SetWindowRgn ScreenToClient ShowWindow LoadBitmapW GetParent InflateRect AttachThreadInput

gdi32

LineTo OffsetRgn MoveToEx CreateRoundRectRgn CreatePen CreateRectRgnIndirect GetTextExtentPoint32W TextOutW RoundRect Rectangle ExtSelectClipRgn GetStretchBltMode GetClipRgn SetViewportOrgEx GetViewportOrgEx SetStretchBltMode CreateFontIndirectW GetTextColor GetStockObject RectInRegion SetTextColor CreateBitmap CreateCompatibleBitmap CreateDIBSection SelectClipRgn GetObjectW CombineRgn DeleteObject CreateRectRgn GetDeviceCaps StretchBlt SetBkMode BitBlt RestoreDC SaveDC ExtTextOutW SetBkColor DeleteDC SelectObject GetCurrentObject CreateCompatibleDC

advapi32

RegQueryValueExA SetSecurityDescriptorDacl InitializeSecurityDescriptor AdjustTokenPrivileges RegDeleteValueW RegDeleteKeyW RegEnumKeyExW LookupPrivilegeValueW CloseServiceHandle StartServiceW OpenServiceW OpenProcessToken OpenSCManagerW CloseEventLog ReadEventLogW OpenEventLogW RegSetValueExW RegQueryValueExW RegCloseKey RegCreateKeyExW RegOpenKeyW RegOpenKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityDescriptorSacl RegOpenKeyExA

shell32

SHCreateDirectoryExW ShellExecuteW SHGetFolderPathW Shell_NotifyIconW

ole32

CreateStreamOnHGlobal

oleaut32

VariantClear SysAllocString SysStringLen SysStringByteLen SystemTimeToVariantTime VariantTimeToSystemTime

shlwapi

SHCreateStreamOnFileEx StrToIntW PathAddBackslashW StrToIntA PathRemoveFileSpecW PathFindFileNameW PathIsDirectoryW PathFileExistsW PathAppendW

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipCreatePath GdipSetStringFormatTrimming GdipCloneBitmapArea GdipDeleteFontFamily GdipFree GdipCreateSolidFill GdipSetClipPath GdipLoadImageFromFileICM GdipSetPenStartCap GdipLoadImageFromFile GdipSetPenEndCap GdiplusShutdown GdiplusStartup GdipGetFontSize GdipDeletePen GdipCloneBrush GdipDrawRectangleI GdipCreateFont GdipCreateFontFromLogfontW GdipDeleteFont GdipGetFamily GdipCreatePen1 GdipCreateHBITMAPFromBitmap GdipDrawLinesI GdipCreateFontFromDC GdipDrawImagePointsRectI GdipDrawImageRectRectI GdipDrawLine GdipAddPathStringI GdipSetStringFormatLineAlign GdipCreateBitmapFromScan0 GdipDrawImageRectRect GdipSetStringFormatAlign GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipAddPathPieI GdipSetStringFormatFlags GdipDeleteStringFormat GdipDrawImageRectI GdipDrawImageI GdipCreateStringFormat GdipAddPathRectangleI GdipPrivateAddFontFile GdipRotateWorldTransform GdipDeletePrivateFontCollection GdipScaleWorldTransform GdipAddPathRectangle GdipNewPrivateFontCollection GdipTranslateWorldTransform GdipMeasureString GdipResetWorldTransform GdipDrawString GdipSetPixelOffsetMode GdipSetPenDashStyle GdipImageRotateFlip GdipCloneFontFamily GdipSetSmoothingMode GdipCreateLineBrushFromRectWithAngleI GdipGetFontCollectionFamilyList GdipGetFontCollectionFamilyCount GdipSetInterpolationMode GdipSetImageAttributesColorMatrix GdipFillPath GdipCreateLineBrushI GdipDisposeImageAttributes GdipSetTextRenderingHint GdipCreateImageAttributes GdipGetImagePixelFormat GdipAddPathArcI GdipDisposeImage GdipSetCompositingQuality GdipFillRectangleI GdipAddPathLineI GdipGetImageHeight GdipFillRectangle GdipSetPenMode GdipGetImageWidth GdipGraphicsClear GdipDeleteGraphics GdipGetImageGraphicsContext GdipClosePathFigure GdipStartPathFigure GdipAlloc GdipCreateFromHDC GdipCloneImage GdipLoadImageFromStream GdipDrawPath GdipLoadImageFromStreamICM GdipDeletePath GdipDeleteBrush

ws2_32

WSAStartup socket closesocket gethostbyname WSACleanup inet_ntoa inet_addr WSAGetLastError recv send getsockname ntohs bind htons getsockopt setsockopt connect __WSAFDIsSet select ioctlsocket WSASetLastError

psapi

GetModuleFileNameExW

iphlpapi

GetNetworkParams IcmpCloseHandle IcmpSendEcho IcmpCreateFile

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-21_713388dadd0c61af0aa024c23ce4a190_elex_remcos_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

ws2_32

psapi

iphlpapi

version

generic