2026-08-05_652b0458c1604f146d428e2eecf50a3e_elex_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_652b0458c1604f146d428e2eecf50a3e_elex_remcos_stop
Size 2.4MB
Sample260805-dkjs9at1ht
SHA256 576ea7faf6cdbaaf3be8e88b117a4bfac6b85ba2cbb42b1b7432de86889fcb7f
MD5 652b0458c1604f146d428e2eecf50a3e
SHA1 e96d39c857b816291bf394890b45e75b1f458cd0
SHA512 73da866b8c2b2b600636f67323be386b61fc3f03f9f986c176c7d877c54ee31eb05d3bf48e5f696514a8a019e88fb073786ae101f4786320c09dd72daf79d708
SSDEEP 49152:k+N/lWDRSVvhbXT7aloJh2xH5TPxbn8Jaj:ky/oSwwCxbn8Jaj
TLSH
T10FC5171FA2719026E86FF3B2C9BD455E8224AE1C1714A4C7728C3D5A3BF15E2E931D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-05_652b0458c1604f146d428e2eecf50a3e_elex_remcos_stop

.exe 2.4MB

2026-08-05_652b0458c1604f146d428e2eecf50a3e_elex_remcos_stop

IMPHASH 66bfad9b0f3d73e37d516694043521df
SHA256 576ea7faf6cdbaaf3be8e88b117a4bfac6b85ba2cbb42b1b7432de86889fcb7f
MD5 652b0458c1604f146d428e2eecf50a3e
SHA1 e96d39c857b816291bf394890b45e75b1f458cd0
SHA512 73da866b8c2b2b600636f67323be386b61fc3f03f9f986c176c7d877c54ee31eb05d3bf48e5f696514a8a019e88fb073786ae101f4786320c09dd72daf79d708
SSDEEP 49152:k+N/lWDRSVvhbXT7aloJh2xH5TPxbn8Jaj:ky/oSwwCxbn8Jaj
TLSH
T10FC5171FA2719026E86FF3B2C9BD455E8224AE1C1714A4C7728C3D5A3BF15E2E931D1E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

72:9a:00:2d:67:24:6c:c7:2b:a1:db:43:f2:b2:0b:07:92:e8:85:65:49:69:1e:8d:43:e6:a9:a0:77:a2:8a:c6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91440400MA7FWRMCXK,CN=珠海市莫停之科技有限公司,O=珠海市莫停之科技有限公司,L=珠海市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c09e78fa0e6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 10, 2026

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

Serial Number

7b:44:70:92:7a:f6:c8:9e:3e:2c:2e:2c:d9:40:da:75

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 21, 2025 - Jan 21, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

741950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\jekins_work\workspace\potplayer_build\product\win32\dbginfo\update.pdb

kernel32

LocalFree SetLastError GetSystemTimeAsFileTime Sleep GetDiskFreeSpaceExW InterlockedIncrement GetExitCodeThread GlobalUnlock OutputDebugStringW FlushInstructionCache InterlockedExchange InterlockedDecrement GlobalLock CreatePipe GetStartupInfoW SetEnvironmentVariableW SleepEx DuplicateHandle ReleaseMutex TerminateThread FormatMessageW SetEnvironmentVariableA CompareStringW CompareStringA CreateProcessA CreateFileA GetLocaleInfoW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle FlushFileBuffers GetCurrentDirectoryA GetFullPathNameA QueryPerformanceCounter GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateFileW GetTimeZoneInformation GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStartupInfoA ReleaseSemaphore SetHandleCount GetModuleFileNameA GetStdHandle GetConsoleMode GetConsoleCP HeapCreate IsValidCodePage GetOEMCP ExitProcess TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleA LCMapStringW LCMapStringA GetCPInfo RtlUnwind FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetThreadLocale GetLocaleInfoA GetACP GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetVersionExA VirtualAlloc VirtualFree GetCurrentProcess GetPrivateProfileIntW SetFileAttributesW MoveFileW lstrlenA SetEvent DeleteFileW OpenEventW lstrlenW GetCurrentThreadId GetLocalTime MoveFileExW GetFileSize MultiByteToWideChar CreateProcessW CreateDirectoryW GetFileAttributesW WideCharToMultiByte GetTickCount FreeResource CreateMutexW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileTime GlobalFree GlobalAlloc SetFileTime SystemTimeToFileTime GetVersionExW GetWindowsDirectoryW GetTempPathW TerminateProcess ReadProcessMemory WritePrivateProfileStringW OutputDebugStringA RemoveDirectoryW FindClose FindNextFileW FindFirstFileW WaitForMultipleObjects RaiseException SetFilePointer SetEndOfFile ResetEvent CreateThread CreateEventW GetCurrentProcessId WaitForSingleObject WriteFile DeleteCriticalSection GetExitCodeProcess LeaveCriticalSection Process32NextW ReadFile Process32FirstW CreateToolhelp32Snapshot GetSystemDirectoryW QueryDosDeviceW GetLogicalDriveStringsW GetFileType EnterCriticalSection InitializeCriticalSection ExpandEnvironmentStringsW Module32NextW Module32FirstW OpenProcess GetPrivateProfileStringW SetErrorMode CopyFileW GetLastError FindResourceExW GetCommandLineW FreeLibrary GetProcAddress LoadLibraryW CloseHandle LockResource GetModuleHandleW LoadResource SizeofResource FindResourceW GetModuleFileNameW GetFileAttributesA

user32

SetActiveWindow IsWindow GetMonitorInfoW GetDlgItem GetWindowLongW EnableWindow SetWindowPos LoadImageW GetWindow SystemParametersInfoW GetActiveWindow SetWindowLongW PostQuitMessage CopyRect UpdateLayeredWindow IntersectRect UnregisterClassA PostMessageW RegisterWindowMessageW ExitWindowsEx FindWindowW GetForegroundWindow FindWindowExW GetWindowThreadProcessId SendMessageW GetWindowRect BringWindowToTop InvalidateRect SetForegroundWindow GetDesktopWindow DrawTextW TranslateMessage GetMessageW PostThreadMessageW DispatchMessageW PeekMessageW GetLastInputInfo IsWindowVisible EnumWindows MapWindowPoints SetRectEmpty GetFocus MoveWindow KillTimer SetCursor IsChild SetFocus IsIconic DestroyWindow GetDC ClientToScreen PtInRect IsDialogMessageW SetWindowTextW ReleaseDC GetNextDlgTabItem IsRectEmpty LoadIconW CreateWindowExW SetRect GetClassInfoExW CallWindowProcW MonitorFromWindow DefWindowProcW SetCapture IsWindowEnabled OffsetRect LoadCursorW EndPaint RegisterClassExW GetSystemMenu BeginPaint ReleaseCapture SetTimer GetClientRect DeleteMenu DestroyIcon EqualRect GetCursorPos GetDlgCtrlID DrawIconEx SetWindowRgn ScreenToClient ShowWindow LoadBitmapW GetParent InflateRect AttachThreadInput

gdi32

LineTo OffsetRgn MoveToEx CreateRoundRectRgn CreatePen CreateRectRgnIndirect GetTextExtentPoint32W TextOutW RoundRect Rectangle ExtSelectClipRgn GetStretchBltMode GetClipRgn SetViewportOrgEx GetViewportOrgEx SetStretchBltMode CreateFontIndirectW GetTextColor GetStockObject RectInRegion SetTextColor CreateBitmap CreateCompatibleBitmap CreateDIBSection SelectClipRgn GetObjectW CombineRgn DeleteObject CreateRectRgn GetDeviceCaps StretchBlt SetBkMode BitBlt RestoreDC SaveDC ExtTextOutW SetBkColor DeleteDC SelectObject GetCurrentObject CreateCompatibleDC

advapi32

RegQueryValueExA SetSecurityDescriptorDacl InitializeSecurityDescriptor AdjustTokenPrivileges RegDeleteValueW RegDeleteKeyW RegEnumKeyExW LookupPrivilegeValueW CloseServiceHandle StartServiceW OpenServiceW OpenProcessToken OpenSCManagerW CloseEventLog ReadEventLogW OpenEventLogW RegSetValueExW RegQueryValueExW RegCloseKey RegCreateKeyExW RegOpenKeyW RegOpenKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityDescriptorSacl RegOpenKeyExA

shell32

SHCreateDirectoryExW ShellExecuteW SHGetFolderPathW Shell_NotifyIconW

ole32

CreateStreamOnHGlobal

oleaut32

VariantClear SysAllocString SysStringLen SysStringByteLen SystemTimeToVariantTime VariantTimeToSystemTime

shlwapi

SHCreateStreamOnFileEx StrToIntW PathAddBackslashW StrToIntA PathRemoveFileSpecW PathFindFileNameW PathIsDirectoryW PathFileExistsW PathAppendW

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipCreatePath GdipSetStringFormatTrimming GdipCloneBitmapArea GdipDeleteFontFamily GdipFree GdipCreateSolidFill GdipSetClipPath GdipLoadImageFromFileICM GdipSetPenStartCap GdipLoadImageFromFile GdipSetPenEndCap GdiplusShutdown GdiplusStartup GdipGetFontSize GdipDeletePen GdipCloneBrush GdipDrawRectangleI GdipCreateFont GdipCreateFontFromLogfontW GdipDeleteFont GdipGetFamily GdipCreatePen1 GdipCreateHBITMAPFromBitmap GdipDrawLinesI GdipCreateFontFromDC GdipDrawImagePointsRectI GdipDrawImageRectRectI GdipDrawLine GdipAddPathStringI GdipSetStringFormatLineAlign GdipCreateBitmapFromScan0 GdipDrawImageRectRect GdipSetStringFormatAlign GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipAddPathPieI GdipSetStringFormatFlags GdipDeleteStringFormat GdipDrawImageRectI GdipDrawImageI GdipCreateStringFormat GdipAddPathRectangleI GdipPrivateAddFontFile GdipRotateWorldTransform GdipDeletePrivateFontCollection GdipScaleWorldTransform GdipAddPathRectangle GdipNewPrivateFontCollection GdipTranslateWorldTransform GdipMeasureString GdipResetWorldTransform GdipDrawString GdipSetPixelOffsetMode GdipSetPenDashStyle GdipImageRotateFlip GdipCloneFontFamily GdipSetSmoothingMode GdipCreateLineBrushFromRectWithAngleI GdipGetFontCollectionFamilyList GdipGetFontCollectionFamilyCount GdipSetInterpolationMode GdipSetImageAttributesColorMatrix GdipFillPath GdipCreateLineBrushI GdipDisposeImageAttributes GdipSetTextRenderingHint GdipCreateImageAttributes GdipGetImagePixelFormat GdipAddPathArcI GdipDisposeImage GdipSetCompositingQuality GdipFillRectangleI GdipAddPathLineI GdipGetImageHeight GdipFillRectangle GdipSetPenMode GdipGetImageWidth GdipGraphicsClear GdipDeleteGraphics GdipGetImageGraphicsContext GdipClosePathFigure GdipStartPathFigure GdipAlloc GdipCreateFromHDC GdipCloneImage GdipLoadImageFromStream GdipDrawPath GdipLoadImageFromStreamICM GdipDeletePath GdipDeleteBrush

ws2_32

WSAStartup socket closesocket gethostbyname WSACleanup inet_ntoa inet_addr WSAGetLastError recv send getsockname ntohs bind htons getsockopt setsockopt connect __WSAFDIsSet select ioctlsocket WSASetLastError

psapi

GetModuleFileNameExW

iphlpapi

GetNetworkParams IcmpCloseHandle IcmpSendEcho IcmpCreateFile

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_652b0458c1604f146d428e2eecf50a3e_elex_remcos_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

ws2_32

psapi

iphlpapi

version

generic