2026-08-02_2288ea057bcabc2074e40db1df178418_elex_maze_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_2288ea057bcabc2074e40db1df178418_elex_maze_remcos
Size 49.6MB
Sample260803-a2jm2aaa49
SHA256 ccdf1b2a710dd3f5b202cd6b2a0ff10e28c70ac6e0dec76347b1876be1cfab1a
MD5 2288ea057bcabc2074e40db1df178418
SHA1 b56e3493485510ded44006019f73e75b279c00ea
SHA512 ca685abab16b18a48764a080ad0b140ffd69e756dbba0c57041306f2ba405f508ab0609e3501e50893d6b24d5553c949f0194ac378933342844b293b266f582b
SSDEEP 786432:k3ulE4ZpDx6fj5EpiL0rZSh4BefubQPNNy3lF0oxNwBjdrrxvWsP39V+e/s2:k3w7p6Z0rjBPUaT0oxeB1OGtVN
TLSH
T183B73349B7521178E51B83B22539FF6719A86C64833884CB679E3B3E4D358E16B3370B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
2026-08-02_2288ea057bcabc2074e40db1df178418_elex_maze_remcos

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-02_2288ea057bcabc2074e40db1df178418_elex_maze_remcos

File Explorer

2026-08-02_2288ea057bcabc2074e40db1df178418_elex_maze_remcos

.exe 49.6MB

2026-08-02_2288ea057bcabc2074e40db1df178418_elex_maze_remcos

IMPHASH 2424ed4495c508a9f6ff3a3e95a240d0
SHA256 ccdf1b2a710dd3f5b202cd6b2a0ff10e28c70ac6e0dec76347b1876be1cfab1a
MD5 2288ea057bcabc2074e40db1df178418
SHA1 b56e3493485510ded44006019f73e75b279c00ea
SHA512 ca685abab16b18a48764a080ad0b140ffd69e756dbba0c57041306f2ba405f508ab0609e3501e50893d6b24d5553c949f0194ac378933342844b293b266f582b
SSDEEP 786432:k3ulE4ZpDx6fj5EpiL0rZSh4BefubQPNNy3lF0oxNwBjdrrxvWsP39V+e/s2:k3w7p6Z0rjBPUaT0oxeB1OGtVN
TLSH
T183B73349B7521178E51B83B22539FF6719A86C64833884CB679E3B3E4D358E16B3370B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5b:2f:9c:91:3d:53:ba:b4:17:9f:91:e5:74:46:dd:d7:05:c2:38:49:65:67:5d:40:7f:15:c8:91:31:0a:cc:86

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Aug 30, 2017

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

44:2c:05:55:04:89:75:11:11:56:96:3d:88:d0:a3:30:55:39:a0:38

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

Aug 30, 2017

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Oct 12, 2018

Timespan

Feb 4, 2016 - Mar 28, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Oct 12, 2018

Timespan

Jan 28, 2016 - Mar 28, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 2, 2011 - Mar 29, 2029

Minor OS version

Major OS version

Entry point

187395

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\rdm\projects\8347\out\Release\QBSetup.pdb

kernel32

DeleteCriticalSection DecodePointer EnterCriticalSection HeapSize GetLastError RaiseException LeaveCriticalSection GetLocalTime RtlCaptureContext CreateProcessW SetUnhandledExceptionFilter GetCurrentProcess GetModuleHandleW CreateEventW WaitForMultipleObjects IsDebuggerPresent GetCurrentThreadId DuplicateHandle CloseHandle GetCurrentProcessId UnmapViewOfFile CreateFileW GetFileSize CreateFileMappingW MapViewOfFile FindClose FindFirstFileW RemoveDirectoryW SetFilePointer WriteFile lstrcmpiW FindNextFileW GetPrivateProfileStringW GetFullPathNameW ReadFile MultiByteToWideChar ExpandEnvironmentStringsW WaitForSingleObject SetEndOfFile VirtualAlloc GetThreadContext SetThreadContext VirtualQuery InterlockedCompareExchange FlushInstructionCache VirtualProtect ResumeThread WideCharToMultiByte SetLastError OutputDebugStringW EncodePointer GetCommandLineW IsProcessorFeaturePresent DeleteFileW GetDriveTypeW RtlUnwind ExitProcess GetModuleHandleExW GetStdHandle GetFileType GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentDirectoryW GetConsoleMode ReadConsoleW IsValidCodePage GetACP GetOEMCP GetCPInfo GetConsoleCP SetFilePointerEx FreeLibrary LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle FlushFileBuffers GetStringTypeW WriteConsoleW InitializeCriticalSectionAndSpinCount GetProcessHeap HeapFree HeapAlloc HeapReAlloc GetProcAddress LoadLibraryW GetTickCount GetTempPathW GetModuleFileNameW DeviceIoControl QueryPerformanceFrequency ReleaseMutex CreateMutexW GetNativeSystemInfo LoadLibraryExA SetEvent GetSystemDefaultLangID InterlockedIncrement GetVersionExW GetFileAttributesW GetSystemDirectoryW GetWindowsDirectoryW CreateThread ExitThread

user32

MessageBoxW

shlwapi

PathRemoveBlanksW PathRemoveFileSpecW PathRemoveBackslashW PathFileExistsW PathCombineW

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegQueryValueExA RegOpenKeyExA

ole32

CoCreateGuid CoTaskMemFree

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ws2_32

htons htonl

netapi32

NetApiBufferFree NetWkstaTransportEnum Netbios

Name

.text

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_2288ea057bcabc2074e40db1df178418_elex_maze_remcos

PE Signature issue

PE Signature issue

kernel32

user32

shlwapi

advapi32

ole32

version

ws2_32

netapi32

generic