2026-07-23_5a09566776d607ffa5243a80570a5387_elex_floxif_remcos_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_5a09566776d607ffa5243a80570a5387_elex_floxif_remcos_stealc_stop
Size 394KB
Sample260723-2pcshade42
SHA256 be6adbdab07dd00c8c3590afacd16524b68385b8a77a636a539ba8057881e209
MD5 5a09566776d607ffa5243a80570a5387
SHA1 86a603f2bd9e782cbd062c117ce75e4b28da54f8
SHA512 a96b14d7a8daea75cd821cf19e1989043a7f604db6a8fccfacd150fd477252e79bc17e0ec9d68eef3f3e795a8d1606392cc22f181abf0eca200717c490d0576c
SSDEEP 6144:8jgCak3ZhNd4YJxSJ++un+gA3X9LoIPCAIfHvq7K4BV+UdvrEFp7hK8T:YfhT4YXSon+5X9LoiCAIfkBjvrEH7r
TLSH
T185846C117601D33AE46700B1EBBE86BD96B86939075520C7E3C84DAD5FAD6E27A3130F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-23_5a09566776d607ffa5243a80570a5387_elex_floxif_remcos_stealc_stop

File Explorer

2026-07-23_5a09566776d607ffa5243a80570a5387_elex_floxif_remcos_stealc_stop

.exe 394KB

2026-07-23_5a09566776d607ffa5243a80570a5387_elex_floxif_remcos_stealc_stop

IMPHASH 512cdf0157f42577d179cbfeade93db4
SHA256 be6adbdab07dd00c8c3590afacd16524b68385b8a77a636a539ba8057881e209
MD5 5a09566776d607ffa5243a80570a5387
SHA1 86a603f2bd9e782cbd062c117ce75e4b28da54f8
SHA512 a96b14d7a8daea75cd821cf19e1989043a7f604db6a8fccfacd150fd477252e79bc17e0ec9d68eef3f3e795a8d1606392cc22f181abf0eca200717c490d0576c
SSDEEP 6144:8jgCak3ZhNd4YJxSJ++un+gA3X9LoIPCAIfHvq7K4BV+UdvrEFp7hK8T:YfhT4YXSon+5X9LoiCAIfkBjvrEH7r
TLSH
T185846C117601D33AE46700B1EBBE86BD96B86939075520C7E3C84DAD5FAD6E27A3130F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ab:3b:9a:8a:13:a5:3a:b5:dd:23:a9:ce:df:83:3f:df:49:95:96:ee

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Chains

May 3, 2013

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Serial Number

10:02:1a:27:d2:83:12:88:5c:61:3a:a4:98:58:0f:6f

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 8, 2011 - Apr 22, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

190808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\ccViews\autobuild1_BR-1304-00YT_6.2_Snapshot\AMT_Development\SW\Src\Services\LMS\Release\LMS.pdb

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailA

ws2_32

htons connect select __WSAFDIsSet ioctlsocket bind listen socket setsockopt WSAAccept freeaddrinfo accept shutdown closesocket getsockname WSAStartup ntohl htonl ntohs WSACreateEvent WSAGetLastError WSACloseEvent WSAResetEvent WSAAddressToStringA WSASetEvent recv send getpeername getaddrinfo

iphlpapi

GetExtendedTcpTable GetAdaptersAddresses CancelIPChangeNotify NotifyAddrChange SetTcpEntry

dnsapi

DnsModifyRecordsInSet_A

crypt32

CryptProtectData CryptUnprotectData

kernel32

VirtualAlloc HeapReAlloc HeapCreate HeapSize GetConsoleCP VirtualFree GetLastError WaitForSingleObject FormatMessageA GetComputerNameExA CreateEventA DuplicateHandle GetCurrentProcess CloseHandle SetEvent ResetEvent CreateFileA GetOverlappedResult GetConsoleMode WriteFile DeviceIoControl FreeLibrary GetProcAddress LoadLibraryA GetModuleFileNameA Sleep GetVersionExA GetModuleHandleA SetConsoleCtrlHandler LocalFree GlobalFree GlobalAlloc GetStdHandle AllocConsole GetCurrentProcessId CreateSemaphoreA ReleaseSemaphore GetCurrentThreadId ResumeThread GetTickCount IsValidCodePage GetOEMCP GetACP ExitProcess GetStartupInfoA SetHandleCount FlushFileBuffers InitializeCriticalSectionAndSpinCount SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetProcessHeap GetSystemTimeAsFileTime GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA CompareStringW SetEnvironmentVariableA SetEndOfFile ReadFile InterlockedIncrement InterlockedDecrement WideCharToMultiByte InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar RtlUnwind HeapAlloc HeapFree ExitThread CreateThread RaiseException TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetStdHandle GetFileType DeleteFileA GetCommandLineA LCMapStringA LCMapStringW GetCPInfo GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError

user32

RegisterDeviceNotificationA DestroyWindow CreateWindowExA RegisterClassA UnregisterDeviceNotification DefWindowProcA

advapi32

CreateServiceA RegDeleteKeyA RegOpenKeyExA RegQueryValueExA RegisterEventSourceA ReportEventA DeregisterEventSource SetServiceStatus RegisterServiceCtrlHandlerExA StartServiceA RegDeleteValueA OpenServiceA ControlService QueryServiceStatus DeleteService RegCreateKeyA RegSetValueExA RegCloseKey OpenSCManagerA ChangeServiceConfig2A CloseServiceHandle StartServiceCtrlDispatcherA GetUserNameA LookupAccountNameA IsValidSid GetLengthSid CopySid

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_5a09566776d607ffa5243a80570a5387_elex_floxif_remcos_stealc_stop

PE Signature issue

setupapi

ws2_32

iphlpapi

dnsapi

crypt32

kernel32

user32

advapi32

generic