2026-07-28_6ef361346ee874c48861977635f25018_elex_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_6ef361346ee874c48861977635f25018_elex_stop
Size 1.2MB
Sample260729-bctblsdq2v
SHA256 ec2c4a52b7b9bfbee0092e284d5eb34d1fb3466c1e522ac0e0535677d8221ce5
MD5 6ef361346ee874c48861977635f25018
SHA1 0e5aed70050044f3921fae631432fd8029b9f119
SHA512 d449ee9017f75bac6d7c39f327f54ae0c47a0972eb01ede767effcdb6c84c489f60cc8fcf9c8a8cf185d94e3c5a07030b949da9a34b63317bd05b49581206a2c
SSDEEP 24576:/VeLT7mBRL3WRBOoJjgRiyTlL8Ynyw4WXz/sNA9My:/Ve6ZGREoJWiyTlwwyw4WXJ
TLSH
T11845AE10E651D136E9EB04B289BB96FF5D34BA20C3A425C7A3C85F2D1B7A5E13E31217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-28_6ef361346ee874c48861977635f25018_elex_stop

.exe 1.2MB

2026-07-28_6ef361346ee874c48861977635f25018_elex_stop

IMPHASH 7e1c334238fa073a47b8a32a02c3e89f
SHA256 ec2c4a52b7b9bfbee0092e284d5eb34d1fb3466c1e522ac0e0535677d8221ce5
MD5 6ef361346ee874c48861977635f25018
SHA1 0e5aed70050044f3921fae631432fd8029b9f119
SHA512 d449ee9017f75bac6d7c39f327f54ae0c47a0972eb01ede767effcdb6c84c489f60cc8fcf9c8a8cf185d94e3c5a07030b949da9a34b63317bd05b49581206a2c
SSDEEP 24576:/VeLT7mBRL3WRBOoJjgRiyTlL8Ynyw4WXz/sNA9My:/Ve6ZGREoJWiyTlwwyw4WXJ
TLSH
T11845AE10E651D136E9EB04B289BB96FF5D34BA20C3A425C7A3C85F2D1B7A5E13E31217
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

c3:33:90:ef:7e:74:19:28:92:e1:d8:71:bc:fd:88:ec:ee:2b:01:34:0a:19:94:ce:ad:8a:a8:5d:eb:6f:be:67

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Chains

Aug 6, 2019

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

bf:9a:0a:70:fd:91:9d:42:7d:6b:02:34:87:9c:77:63:ba:8f:69:a4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Chains

Aug 6, 2019

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Serial Number

07:8f:d1:48:0a:d2:92:72:fb:1f:57:61:4e:67:02:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 4, 2017 - Oct 1, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Serial Number

34:cb:7f:a7:1d:10:18:43:27:bd:00:97:c4:b3:0a:c0

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2017 - Oct 1, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

515234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapReAlloc HeapSize GetProcessHeap InterlockedCompareExchange ReleaseMutex CreateMutexW CreateDirectoryW CreateThread GetCommandLineW GetModuleHandleW LoadLibraryExW InterlockedDecrement InterlockedIncrement CopyFileW GetCurrentProcessId DeleteCriticalSection InitializeCriticalSection SetFilePointer CreateFileMappingW MapViewOfFile UnmapViewOfFile RemoveDirectoryW lstrcpynW SetLastError GetCurrentThreadId WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InitializeCriticalSectionAndSpinCount FlushFileBuffers QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleHandleA GetStringTypeW GetStringTypeA GetLocaleInfoA FindFirstFileW FindNextFileW FindClose FreeLibrary LocalAlloc LocalFree LoadLibraryW GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW GetModuleFileNameA GetSystemDirectoryW lstrcmpW GetCurrentDirectoryW LeaveCriticalSection EnterCriticalSection GetShortPathNameW GetEnvironmentVariableW SetPriorityClass GetCurrentThread HeapFree SetProcessPriorityBoost RaiseException DeleteFileW MoveFileExW lstrcatW WaitForSingleObject GetSystemDefaultUILanguage GetLocaleInfoW GetACP GetLocalTime CreateFileA GetFileSize GetTempPathW GetTickCount WriteFile CreateFileW ReadFile CreateProcessW CloseHandle GetLastError Sleep CompareStringW GetCurrentProcess FlushInstructionCache lstrlenW lstrcpyW lstrcmpiW OpenProcess TerminateProcess MultiByteToWideChar GetModuleHandleExW IsValidCodePage GetOEMCP GetStartupInfoA SetHandleCount GetConsoleMode GetConsoleCP TlsFree TlsSetValue TlsAlloc TlsGetValue GetStdHandle HeapCreate GetCPInfo LCMapStringW LCMapStringA GetStartupInfoW GetSystemTimeAsFileTime HeapDestroy MoveFileW GetModuleFileNameW GetNativeSystemInfo IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind MulDiv SetFileTime DosDateTimeToFileTime SystemTimeToFileTime DuplicateHandle GetFileType ExitProcess FreeResource WideCharToMultiByte GetVersionExW lstrcmpiA VirtualAlloc SetThreadPriority HeapAlloc VirtualFree IsProcessorFeaturePresent FindResourceExW FindResourceW LoadResource LockResource SizeofResource LoadLibraryA

user32

GetWindowTextLengthW EnableWindow IsDlgButtonChecked SetDlgItemTextW GetParent GetDlgItem GetWindowTextW SetWindowTextW GetWindowLongW CreateWindowExW SetWindowLongW MessageBoxW FillRect EndPaint BeginPaint GetClientRect SendMessageW LoadStringW GetMessageW TranslateMessage DispatchMessageW wsprintfW EnumWindows GetSystemMetrics LoadImageW CreateDialogParamW GetSysColor GetFocus GetCapture UnregisterClassA RegisterClassExW GetWindowRgn IntersectRect GetKeyState IsRectEmpty GetUpdateRect SetTimer KillTimer PostMessageW InflateRect RegisterClassW GetClassInfoExW GetPropW SetPropW IsIconic IsZoomed SetWindowRgn CharPrevW SetRect CreateCaret HideCaret ShowCaret SetCaretPos ClientToScreen GetCaretPos InvalidateRgn CreateAcceleratorTableW ReleaseCapture GetCursorPos SetCursor DrawFocusRect PtInRect CallWindowProcW GetDlgCtrlID SetFocus SetCapture IsWindowEnabled InvalidateRect UpdateWindow SetRectEmpty DefWindowProcW PostQuitMessage GetWindow MonitorFromWindow GetMonitorInfoW MapWindowPoints IsDialogMessageW ShowWindow ScreenToClient GetWindowRect MoveWindow DestroyWindow FindWindowExW GetClassNameW LoadCursorW OffsetRect ReleaseDC GetDC CharNextW DrawTextW SetWindowPos IsWindow

gdi32

CreateDIBSection CreateCompatibleDC CreateRectRgn PtInRegion CreatePen SetWindowOrgEx Rectangle RestoreDC BitBlt SaveDC CreateCompatibleBitmap GetTextMetricsW CreateRoundRectRgn SelectClipRgn ExtSelectClipRgn CreateSolidBrush GetClipBox CombineRgn StretchBlt SetStretchBltMode ExtTextOutW SetBkColor LineTo MoveToEx CreatePenIndirect RoundRect TextOutW GetTextExtentPoint32W GetCharABCWidthsW GetDeviceCaps GetObjectA DeleteObject DeleteDC GetObjectW SelectObject CreateFontIndirectW GetStockObject SetBkMode SetTextColor CreateRectRgnIndirect

advapi32

CryptDestroyHash RegQueryValueExA CryptReleaseContext RegSetValueExA ControlService DeleteService RegQueryInfoKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenCurrentUser LookupAccountSidW RegOpenKeyW CreateProcessAsUserA DuplicateTokenEx SetTokenInformation EqualSid GetTokenInformation OpenProcessToken RegEnumKeyExW RegDeleteKeyW RegOpenKeyExA RegCreateKeyExA OpenSCManagerW OpenServiceW CloseServiceHandle AllocateAndInitializeSid FreeSid RegQueryValueExW RegOpenKeyExW RegCloseKey CryptAcquireContextW CryptCreateHash CryptHashData CryptGetHashParam

shell32

SHChangeNotify ShellExecuteW SHFileOperationW SHGetPathFromIDListW SHGetSpecialFolderLocation CommandLineToArgvW ShellExecuteA ShellExecuteExW

ole32

CoUninitialize CLSIDFromProgID OleLockRunning CoTaskMemRealloc CoTaskMemAlloc CoCreateGuid CLSIDFromString ProgIDFromCLSID CoCreateInstance CoTaskMemFree CoInitialize

oleaut32

VarUI4FromStr SysFreeString VariantClear SysAllocString VariantInit

shlwapi

PathIsDirectoryW SHDeleteKeyW PathAddBackslashW StrStrW PathRemoveFileSpecA PathAppendA PathAppendW PathFileExistsW PathFindFileNameW StrCatW PathFileExistsA

comctl32

ord17 _TrackMouseEvent

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

wininet

HttpQueryInfoW InternetCloseHandle InternetOpenW InternetSetOptionW InternetConnectW HttpOpenRequestW HttpSendRequestW InternetReadFile

dbghelp

ImageRvaToVa

crypt32

CryptQueryObject CertGetNameStringW CryptMsgGetParam CertFindCertificateInStore CertCloseStore CryptMsgClose CertFreeCertificateContext

gdiplus

GdipAlloc GdipCloneBrush GdipFree GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipCreateFromHDC GdiplusStartup GdiplusShutdown GdipDeleteFont GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteBrush GdipDrawString GdipCreateLineBrushI GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipCreateStringFormat GdipSetTextRenderingHint

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_6ef361346ee874c48861977635f25018_elex_stop

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

wtsapi32

wininet

dbghelp

crypt32

gdiplus

imm32

generic