2026-07-31_9df237be1883701a2cc5d86682a5bf44_betabot_eclipse_elex_glooxmail_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_9df237be1883701a2cc5d86682a5bf44_betabot_eclipse_elex_glooxmail_remcos_stop
Size 365KB
Sample260731-c8t4fshr4w
SHA256 6e355db50c9b22c971f3ff8b17a927969c541497e7c5fe9d274ec6024d96eef3
MD5 9df237be1883701a2cc5d86682a5bf44
SHA1 f8d292233bb32936ac1c750352d656ac19eff965
SHA512 4be6f8da447f3de42cf8266995a8be51913e68b259cf40088b77c27c3e1338f97ad6dd918c063b35f0c2c3c156b4651b243a8b5331859478336adc3c4c510363
SSDEEP 6144:BWTWJpRckqwQYqDAWCT2h7dorh0Q4MYVArIxWwzmx:BWT84kqwaDRC27dor+E6ArIxzzmx
TLSH
T1E684AD36B340D07AD9230076899AD7B4D67AA5B06D744203B7E8E7ACEF74293D934B43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_9df237be1883701a2cc5d86682a5bf44_betabot_eclipse_elex_glooxmail_remcos_stop

File Explorer

2026-07-31_9df237be1883701a2cc5d86682a5bf44_betabot_eclipse_elex_glooxmail_remcos_stop

.exe 365KB

2026-07-31_9df237be1883701a2cc5d86682a5bf44_betabot_eclipse_elex_glooxmail_remcos_stop

IMPHASH 575bea33c07ba13e0a5066f27c5de309
SHA256 6e355db50c9b22c971f3ff8b17a927969c541497e7c5fe9d274ec6024d96eef3
MD5 9df237be1883701a2cc5d86682a5bf44
SHA1 f8d292233bb32936ac1c750352d656ac19eff965
SHA512 4be6f8da447f3de42cf8266995a8be51913e68b259cf40088b77c27c3e1338f97ad6dd918c063b35f0c2c3c156b4651b243a8b5331859478336adc3c4c510363
SSDEEP 6144:BWTWJpRckqwQYqDAWCT2h7dorh0Q4MYVArIxWwzmx:BWT84kqwaDRC27dor+E6ArIxzzmx
TLSH
T1E684AD36B340D07AD9230076899AD7B4D67AA5B06D744203B7E8E7ACEF74293D934B43
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

153828

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\code\glooxtest\Release\glooxtest.pdb

kernel32

GetVersionExA CloseHandle InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection LocalReAlloc FileTimeToSystemTime MultiByteToWideChar LocalAlloc LocalFree CreateFileA GetCurrentProcess OpenProcess WideCharToMultiByte GetProcAddress GetModuleHandleA ReadFile TerminateProcess CreateProcessA CreateEventA Sleep TerminateThread CompareStringW CreatePipe GetProcessHeap SetEndOfFile FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW SetStdHandle InitializeCriticalSectionAndSpinCount LoadLibraryA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings GetLastError GetStartupInfoA CompareStringA WriteFile SetEvent WaitForSingleObject PeekNamedPipe GetSystemDirectoryA InterlockedIncrement InterlockedDecrement InterlockedExchange ExitThread GetCurrentThreadId CreateThread UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree GetSystemTimeAsFileTime HeapAlloc HeapReAlloc GetCommandLineA RaiseException RtlUnwind GetCPInfo LCMapStringA LCMapStringW GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError ExitProcess GetStdHandle GetModuleFileNameA GetConsoleCP GetConsoleMode SetFilePointer HeapSize HeapCreate VirtualFree VirtualAlloc GetTimeZoneInformation FreeEnvironmentStringsA SetEnvironmentVariableA

advapi32

GetTokenInformation LookupAccountSidA LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken

ws2_32

connect WSAStartup getprotobyname setsockopt WSACleanup closesocket recv select __WSAFDIsSet send htons gethostname inet_ntoa gethostbyname socket

secur32

FreeContextBuffer EncryptMessage InitializeSecurityContextA AcquireCredentialsHandleA FreeCredentialsHandle DecryptMessage DeleteSecurityContext QueryContextAttributesA

dnsapi

DnsFree DnsQuery_A

crypt32

CertFreeCertificateChain CertGetCertificateChain CertVerifyCertificateChainPolicy CertNameToStrA

Name

.text

Size

256KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.htext

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_9df237be1883701a2cc5d86682a5bf44_betabot_eclipse_elex_glooxmail_remcos_stop

kernel32

advapi32

ws2_32

secur32

dnsapi

crypt32

generic