2026-07-28_87a017a0cfdfa32c4f0125b91042ca1d_elex_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_87a017a0cfdfa32c4f0125b91042ca1d_elex_remcos_stop
Size 898KB
Sample260728-vncmsaad84
SHA256 1c84cb9f7d73ebcada161c0f2e9ce0e70d686a4de4b1a32e2ff821a31aaf7471
MD5 87a017a0cfdfa32c4f0125b91042ca1d
SHA1 9daf2f30d43b31f97bddb8c4ed0bb46edc853bc9
SHA512 1d849a196259043b2240dff9ebe0bcc2fbe107e0de9f171a21d80071a1ef76e815a9d560dcb2d59df3fd13c0159377a3be49d0775532f40fd04d6e2f52a36a94
SSDEEP 12288:Q2qFMS6o4LC0zblEOGSEzUvzblE4wEQRUSEcfv44IdmIKy:rBSN4LC0+OP+ac34
TLSH
T1F215BF10F7DAC171E9AB27B018301D281A3ABE853B74C6CF978D7A19CA723D29C75716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-28_87a017a0cfdfa32c4f0125b91042ca1d_elex_remcos_stop

File Explorer

2026-07-28_87a017a0cfdfa32c4f0125b91042ca1d_elex_remcos_stop

.exe 898KB

2026-07-28_87a017a0cfdfa32c4f0125b91042ca1d_elex_remcos_stop

IMPHASH d182bae9bf97565513e3309257f7d475
SHA256 1c84cb9f7d73ebcada161c0f2e9ce0e70d686a4de4b1a32e2ff821a31aaf7471
MD5 87a017a0cfdfa32c4f0125b91042ca1d
SHA1 9daf2f30d43b31f97bddb8c4ed0bb46edc853bc9
SHA512 1d849a196259043b2240dff9ebe0bcc2fbe107e0de9f171a21d80071a1ef76e815a9d560dcb2d59df3fd13c0159377a3be49d0775532f40fd04d6e2f52a36a94
SSDEEP 12288:Q2qFMS6o4LC0zblEOGSEzUvzblE4wEQRUSEcfv44IdmIKy:rBSN4LC0+OP+ac34
TLSH
T1F215BF10F7DAC171E9AB27B018301D281A3ABE853B74C6CF978D7A19CA723D29C75716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

52:a4:74:6c:bb:0d:8a:79:bf:c6:1b:e2:02:08:95:fa:14:cb:c2:df

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Chains

Jul 7, 2008

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Serial Number

48:ee:2c:9d:ad:71:45:09:44:a1:13:71:a8:0c:00:69

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 21, 2008 - Apr 23, 2011

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

Major OS version

Entry point

214269

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\ccviews\autobuild1_br-0806-0875_14.34_snapshot\workingdirectory1\hdmiinstaller\1.1.12\installer\hdmi\release\Setup.pdb

setupapi

SetupGetLineTextW SetupFindNextLine SetupCloseInfFile SetupFindFirstLineW SetupOpenInfFileW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetINFClassW SetupDiGetDeviceRegistryPropertyW SetupCopyOEMInfW SetupGetStringFieldW

shlwapi

PathIsDirectoryEmptyW PathFileExistsW PathIsRootW PathRemoveFileSpecW PathAppendW PathFindFileNameW

kernel32

CreateThread VerifyVersionInfoW VerSetConditionMask FindNextFileW FindClose FindFirstFileW GetLocalTime GetCurrentProcess GetProcAddress GetModuleHandleW GetVersionExW TerminateProcess OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot FreeLibrary LoadLibraryW GetSystemDirectoryW GetFileAttributesW WriteFile CreateFileA GetModuleFileNameA GetTempPathA GetModuleFileNameW GetWindowsDirectoryW RemoveDirectoryW MoveFileExW DeleteFileW SetFileAttributesW Sleep CopyFileW ExitProcess CreateProcessW CreateEventW OutputDebugStringW ConvertDefaultLocale GetSystemDefaultLangID EnumResourceLanguagesW SetFilePointer GetCurrentProcessId GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA InitializeCriticalSection GetStdHandle HeapReAlloc VirtualAlloc EnterCriticalSection LeaveCriticalSection DeleteCriticalSection VirtualFree HeapCreate HeapDestroy LCMapStringW WideCharToMultiByte LCMapStringA GetOEMCP SetEvent FindResourceW SizeofResource LoadResource LockResource MultiByteToWideChar CreateFileW GetFileSize ReadFile CloseHandle WaitForSingleObject SetLastError GetLastError GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers GetLocaleInfoW GetACP GetCPInfo HeapSize InterlockedDecrement GetCurrentThreadId InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoW GetProcessHeap GetVersionExA GetModuleHandleA HeapAlloc HeapFree RtlUnwind LocalAlloc InterlockedExchange LoadLibraryA RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent

user32

KillTimer SetTimer ShowWindow EnableWindow MapDialogRect LoadImageW DialogBoxParamW PostMessageW SendDlgItemMessageW EndDialog SetDlgItemTextW SetWindowTextW SetFocus SetWindowPos GetDlgItem SendMessageW GetDC ExitWindowsEx GetWindowThreadProcessId GetWindowModuleFileNameW EnumWindows MessageBoxW LoadStringW wsprintfW LoadIconW ReleaseDC

gdi32

GetTextExtentPoint32W SetTextColor SetBkMode GetStockObject GetObjectW CreateFontIndirectW DeleteObject CreateSolidBrush CreateFontW SelectObject

advapi32

AdjustTokenPrivileges RegDeleteValueW RegEnumValueW RegQueryValueExW CreateServiceW ChangeServiceConfigW ChangeServiceConfig2W StartServiceW QueryServiceStatus ControlService DeleteService OpenSCManagerW OpenServiceW CloseServiceHandle RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegDeleteKeyW OpenProcessToken LookupPrivilegeValueW IsTextUnicode

shell32

SHGetFolderPathW ShellExecuteA SHCreateDirectoryExW

ole32

OleInitialize OleUninitialize CoInitialize CoCreateInstance

psapi

EnumProcessModules EnumProcesses GetModuleFileNameExW GetModuleBaseNameW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_87a017a0cfdfa32c4f0125b91042ca1d_elex_remcos_stop

PE Signature issue

setupapi

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

psapi

version

generic