2026-07-31_4de089d1f5493cf21d65afaf9af14ca3_elex_remcos_stop_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_4de089d1f5493cf21d65afaf9af14ca3_elex_remcos_stop_virut
Size 1.0MB
Sample260731-dpg58abh36
SHA256 049a00074d5f1dd4437e460cb91939bb07560c3e158451a52bceced1178c2175
MD5 4de089d1f5493cf21d65afaf9af14ca3
SHA1 6e79737e0c6869a7eaaf74b516381be0085d8773
SHA512 6dec2ea8c87a344b22014e6d898cea0a2b6cc69d68a5c50e6f4f03e8447e237e80876d0a21b5b5fdd73b2ce6da80cf172e8d2e79bf31cb104d4f87231bef5eab
SSDEEP 24576:8TWHhEbYjZgTzCQgRGVFBgYaVrUsCwnTh/g15S7:SWhaHCJlfCwnTh/I5
TLSH
T1FD358C51FBCBD0B3CA870072095AD74EE536F5961B246BDFE3981B0E5D692C03D3628A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-31_4de089d1f5493cf21d65afaf9af14ca3_elex_remcos_stop_virut

File Explorer

2026-07-31_4de089d1f5493cf21d65afaf9af14ca3_elex_remcos_stop_virut

.exe 1.0MB

2026-07-31_4de089d1f5493cf21d65afaf9af14ca3_elex_remcos_stop_virut

IMPHASH 506e98b6bbc4ec78adcf851d58f93320
SHA256 049a00074d5f1dd4437e460cb91939bb07560c3e158451a52bceced1178c2175
MD5 4de089d1f5493cf21d65afaf9af14ca3
SHA1 6e79737e0c6869a7eaaf74b516381be0085d8773
SHA512 6dec2ea8c87a344b22014e6d898cea0a2b6cc69d68a5c50e6f4f03e8447e237e80876d0a21b5b5fdd73b2ce6da80cf172e8d2e79bf31cb104d4f87231bef5eab
SSDEEP 24576:8TWHhEbYjZgTzCQgRGVFBgYaVrUsCwnTh/g15S7:SWhaHCJlfCwnTh/I5
TLSH
T1FD358C51FBCBD0B3CA870072095AD74EE536F5961B246BDFE3981B0E5D692C03D3628A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

2b:2e:f5:30:b7:84:45:63:ab:c0:fc:21:9c:11:12:ad:d6:0d:60:ee:0e:64:30:ad:a7:a7:f8:d0:13:2f:e9:db

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Chains

Dec 25, 2024

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

4a:2a:b2:23:18:5e:83:b8:dc:60:72:76:80:f6:48:19:1a:33:c3:67

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Chains

Dec 25, 2024

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Serial Number

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2023 - Oct 30, 2034

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Serial Number

0d:6a:73:d0:15:d3:84:9c:e5:43:01:d1:77:5c:08:f4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 20, 2023 - Oct 22, 2026

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1073345

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\ME\1_5_1_BRANCH\project\bin\release\kernelUpdate.pdb

kernel32

ReleaseMutex WaitForSingleObject SetEvent GetACP CreateMutexW WideCharToMultiByte GetModuleFileNameW TlsAlloc TlsFree GetLastError GetSystemTimeAsFileTime PostQueuedCompletionStatus Sleep EnterCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedExchangeAdd InterlockedDecrement InterlockedExchange MultiByteToWideChar InitializeCriticalSection GetQueuedCompletionStatus LeaveCriticalSection GetCurrentThreadId ReleaseSemaphore DuplicateHandle GetCurrentProcess CreateSemaphoreA GetCurrentProcessId OutputDebugStringA HeapFree GetLocalTime CreateFileW SetEndOfFile SetLastError TlsGetValue CreateIoCompletionPort HeapAlloc InterlockedCompareExchange TlsSetValue WriteFile GetProcAddress CreateEventW TerminateThread QueueUserAPC SleepEx GetModuleHandleA GetVersion GetFileType GetStdHandle SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP CloseHandle CreateEventA GetProcessHeap CreateMutexA WriteConsoleA GetLocaleInfoW GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA SetFilePointer SetStdHandle IsValidCodePage GetOEMCP QueryPerformanceCounter GetStartupInfoA SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA ReadFile HeapCreate HeapDestroy VirtualAlloc VirtualFree LocalFree FormatMessageA GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA GetFileAttributesW CreateFileA FindClose RemoveDirectoryW DeleteFileW CreateDirectoryW MoveFileW MoveFileA FindFirstFileW FindNextFileW ResetEvent ResumeThread GetTickCount SystemTimeToFileTime WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetVersionExA ExitThread CreateThread HeapReAlloc RaiseException RtlUnwind GetCPInfo HeapSize ExitProcess GetModuleFileNameA GetConsoleCP GetConsoleMode FlushFileBuffers

user32

GetDesktopWindow MessageBoxA GetProcessWindowStation GetUserObjectInformationW LoadStringA

advapi32

ReportEventA DeregisterEventSource RegisterEventSourceA

shell32

SHGetFolderPathW

ws2_32

getservbyname WSASend ntohl gethostbyname select WSAGetLastError getsockopt WSARecv connect bind listen WSAStringToAddressA WSASetLastError inet_addr getsockname WSAStartup WSACleanup htons setsockopt WSASocketW accept closesocket htonl ioctlsocket __WSAFDIsSet

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_4de089d1f5493cf21d65afaf9af14ca3_elex_remcos_stop_virut

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

ws2_32

generic