2026-08-05_8a3fc153dee8565dcdbd45c76a1d2b0e_elex_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_8a3fc153dee8565dcdbd45c76a1d2b0e_elex_remcos_stop
Size 1.9MB
Sample260805-jmgdsscm2x
SHA256 3a5f86f56fca7989cba64a4b26a2b61e22404c8df1559cef16bb8a87121049fc
MD5 8a3fc153dee8565dcdbd45c76a1d2b0e
SHA1 6870043abf666510efb8c8cb50c8afee4ae6d586
SHA512 28a000ea757277e9b2891d0986cf10874c71729f3a2a4b78c9f7cf0b0332352e5ebd07cfed49e2722a9e8db3d067c5c9ce161b0cd922e60be80f297768cb7146
SSDEEP 49152:/CpkkEK25k2TmPoJhBxZyxv5pgxv5psxbn8Jaj:/CSOLwOxv5pgxv5psxbn8Jaj
TLSH
T13C955D31368BD67AE0228F7DAF54E23891626C61F1BB545736AC79084BB84F0DF322D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-05_8a3fc153dee8565dcdbd45c76a1d2b0e_elex_remcos_stop

.exe 1.9MB

2026-08-05_8a3fc153dee8565dcdbd45c76a1d2b0e_elex_remcos_stop

IMPHASH 07bb515f95393ce67c081bd48f0d2903
SHA256 3a5f86f56fca7989cba64a4b26a2b61e22404c8df1559cef16bb8a87121049fc
MD5 8a3fc153dee8565dcdbd45c76a1d2b0e
SHA1 6870043abf666510efb8c8cb50c8afee4ae6d586
SHA512 28a000ea757277e9b2891d0986cf10874c71729f3a2a4b78c9f7cf0b0332352e5ebd07cfed49e2722a9e8db3d067c5c9ce161b0cd922e60be80f297768cb7146
SSDEEP 49152:/CpkkEK25k2TmPoJhBxZyxv5pgxv5psxbn8Jaj:/CSOLwOxv5pgxv5psxbn8Jaj
TLSH
T13C955D31368BD67AE0228F7DAF54E23891626C61F1BB545736AC79084BB84F0DF322D5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

5e:83:ac:39:0c:6c:85:a1:80:e3:67:89:c1:2a:16:69:ab:3c:bf:ee:47:ba:69:da:53:7e:1b:2b:83:9a:55:95

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91440400MA7FWRMCXK,CN=珠海市莫停之科技有限公司,O=珠海市莫停之科技有限公司,L=珠海市,ST=广东省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c09e78fa0e6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 8, 2025

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Timestamp 2025,O=Asseco Data Systems S.A.,C=PL

Serial Number

9e:9c:04:f6:55:a8:b4:a7:02:6d:49:8c:6c:78:8d:aa

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 9, 2025 - Jan 7, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

Serial Number

7b:44:70:92:7a:f6:c8:9e:3e:2c:2e:2c:d9:40:da:75

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 21, 2025 - Jan 21, 2028

Minor OS version

Major OS version

Entry point

537742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\jekins_work\workspace\sysfix_build_all_files\product\win32\dbginfo\update.pdb

kernel32

SetLastError LocalFree GetSystemTimeAsFileTime GetDiskFreeSpaceExW Sleep InterlockedIncrement GetExitCodeThread FlushInstructionCache OutputDebugStringW InterlockedExchange InterlockedDecrement GlobalLock GlobalUnlock CreatePipe GetStartupInfoW SetEnvironmentVariableW SleepEx DuplicateHandle ReleaseMutex TerminateThread FormatMessageW SetEnvironmentVariableA CompareStringW CompareStringA CreateProcessA CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW SetStdHandle FlushFileBuffers GetCurrentDirectoryA GetFullPathNameA QueryPerformanceCounter GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CreateProcessW GetTimeZoneInformation GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStartupInfoA GetFileType VirtualAlloc GetConsoleMode GetConsoleCP HeapCreate GetStdHandle ExitProcess TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleA IsValidCodePage GetOEMCP GetCPInfo LCMapStringW LCMapStringA RtlUnwind FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetThreadLocale GetLocaleInfoA GetACP GetVersionExA GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy VirtualFree SystemTimeToTzSpecificLocalTime CreateDirectoryW GetFileAttributesW WideCharToMultiByte GetTickCount FreeResource InitializeCriticalSection ExpandEnvironmentStringsW Module32NextW Module32FirstW OpenProcess WaitForSingleObject WriteFile DeleteCriticalSection LeaveCriticalSection GetExitCodeProcess QueryDosDeviceW ReadFile Process32NextW Process32FirstW GetLogicalDriveStringsW CreateToolhelp32Snapshot GetSystemDirectoryW FileTimeToSystemTime GetFileTime GlobalFree GlobalAlloc SystemTimeToFileTime GetVersionExW GetWindowsDirectoryW TerminateProcess ReadProcessMemory WritePrivateProfileStringW OutputDebugStringA RemoveDirectoryW FindClose FindNextFileW FindFirstFileW GetModuleFileNameA WaitForMultipleObjects RaiseException SetFilePointer SetEndOfFile GetCurrentProcessId ResetEvent CreateThread CreateEventW GetPrivateProfileIntW SetFileAttributesW MoveFileW lstrlenA SetEvent DeleteFileW OpenEventW GetCurrentThreadId lstrlenW MoveFileExW MultiByteToWideChar GetLocalTime SetHandleCount GetFileSize EnterCriticalSection CreateFileW GetCurrentProcess SetErrorMode CopyFileW GetPrivateProfileStringW FreeLibrary GetCommandLineW GetProcAddress LoadLibraryW CloseHandle LockResource GetModuleHandleW LoadResource GetModuleFileNameW SizeofResource GetLastError FindResourceW CreateMutexW FindResourceExW GetFileAttributesA

user32

IsWindow CopyRect PostMessageW RegisterWindowMessageW KillTimer MoveWindow SetCursor GetClassInfoExW UpdateLayeredWindow GetFocus IntersectRect IsChild SetFocus InflateRect SetWindowTextW IsDialogMessageW GetNextDlgTabItem SetRectEmpty IsIconic DestroyWindow GetDesktopWindow DrawTextW FindWindowW GetForegroundWindow FindWindowExW ExitWindowsEx GetWindowThreadProcessId SendMessageW AttachThreadInput GetWindowRect CallWindowProcW InvalidateRect SetForegroundWindow PostThreadMessageW DispatchMessageW PeekMessageW TranslateMessage GetMessageW GetLastInputInfo IsWindowVisible EnumWindows MapWindowPoints ClientToScreen PtInRect EndPaint ReleaseDC IsRectEmpty LoadIconW BeginPaint CreateWindowExW SetRect GetCursorPos DefWindowProcW SetCapture IsWindowEnabled OffsetRect LoadCursorW GetSystemMenu RegisterClassExW DrawIconEx SetWindowRgn ScreenToClient GetClientRect DeleteMenu ReleaseCapture SetTimer EqualRect GetActiveWindow GetWindow DestroyIcon SetWindowLongW EnableWindow GetWindowLongW GetDlgCtrlID SystemParametersInfoW ShowWindow GetMonitorInfoW LoadBitmapW GetParent SetActiveWindow LoadImageW SetWindowPos PostQuitMessage GetDlgItem GetDC MonitorFromWindow BringWindowToTop UnregisterClassA

gdi32

SelectClipRgn SetBkColor CreateCompatibleDC SetBkMode LineTo RestoreDC MoveToEx SaveDC CreatePen RectInRegion OffsetRgn CreateRoundRectRgn CreateRectRgnIndirect GetTextExtentPoint32W TextOutW GetStretchBltMode RoundRect Rectangle CreateFontIndirectW ExtTextOutW ExtSelectClipRgn GetClipRgn SetTextColor SetViewportOrgEx CreateBitmap GetViewportOrgEx CreateCompatibleBitmap SetStretchBltMode CreateDIBSection GetObjectW GetTextColor CombineRgn DeleteObject GetCurrentObject CreateRectRgn GetDeviceCaps StretchBlt DeleteDC SelectObject GetStockObject BitBlt

advapi32

CloseServiceHandle InitializeSecurityDescriptor RegEnumKeyExW LookupPrivilegeValueW StartServiceW OpenServiceW OpenProcessToken CloseEventLog OpenSCManagerW ReadEventLogW OpenEventLogW AdjustTokenPrivileges RegDeleteValueW RegDeleteKeyW RegSetValueExW RegQueryValueExW RegCloseKey RegCreateKeyExW RegOpenKeyW RegOpenKeyExW RegOpenKeyExA RegQueryValueExA ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityDescriptorSacl SetSecurityDescriptorDacl

shell32

ShellExecuteW Shell_NotifyIconW SHGetFolderPathW

ole32

CreateStreamOnHGlobal

oleaut32

VariantTimeToSystemTime SystemTimeToVariantTime

shlwapi

PathFileExistsW PathIsDirectoryW PathFindFileNameW PathRemoveFileSpecW StrToIntA PathAddBackslashW StrToIntW PathAppendW

comctl32

_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipCreateFromHDC GdipCloneImage GdipLoadImageFromStream GdipDrawPath GdipDeletePath GdipSetPenEndCap GdipCloneBrush GdipDrawRectangleI GdipDeleteFontFamily GdipFree GdipAlloc GdipStartPathFigure GdipClosePathFigure GdipGetImageGraphicsContext GdipDeleteGraphics GdipGraphicsClear GdipDeletePen GdipSetPenStartCap GdipSetClipPath GdipCreateSolidFill GdipCreatePath GdipDeleteBrush GdipGetFamily GdiplusShutdown GdiplusStartup GdipGetFontSize GdipCreatePen1 GdipDeleteFont GdipSetStringFormatTrimming GdipCloneBitmapArea GdipCreateFont GdipCreateFontFromLogfontW GdipCreateHBITMAPFromBitmap GdipDrawLinesI GdipDrawImagePointsRectI GdipDrawImageRectRectI GdipDrawLine GdipAddPathStringI GdipSetStringFormatLineAlign GdipCreateBitmapFromScan0 GdipDrawImageRectRect GdipSetStringFormatAlign GdipCreateBitmapFromStream GdipAddPathPieI GdipSetStringFormatFlags GdipDeleteStringFormat GdipDrawImageRectI GdipDrawImageI GdipCreateStringFormat GdipAddPathRectangleI GdipPrivateAddFontFile GdipRotateWorldTransform GdipDeletePrivateFontCollection GdipScaleWorldTransform GdipAddPathRectangle GdipNewPrivateFontCollection GdipTranslateWorldTransform GdipMeasureString GdipResetWorldTransform GdipDrawString GdipSetPixelOffsetMode GdipSetPenDashStyle GdipImageRotateFlip GdipCloneFontFamily GdipSetSmoothingMode GdipCreateLineBrushFromRectWithAngleI GdipGetFontCollectionFamilyList GdipGetFontCollectionFamilyCount GdipSetInterpolationMode GdipSetImageAttributesColorMatrix GdipFillPath GdipCreateLineBrushI GdipDisposeImageAttributes GdipSetTextRenderingHint GdipCreateImageAttributes GdipGetImagePixelFormat GdipAddPathArcI GdipDisposeImage GdipSetCompositingQuality GdipFillRectangleI GdipAddPathLineI GdipGetImageHeight GdipFillRectangle GdipSetPenMode GdipGetImageWidth GdipLoadImageFromFile

ws2_32

WSASetLastError connect ioctlsocket select WSAStartup socket closesocket gethostbyname WSACleanup inet_addr inet_ntoa WSAGetLastError recv send getsockname ntohs bind htons getsockopt setsockopt __WSAFDIsSet

psapi

GetModuleFileNameExW

iphlpapi

GetNetworkParams IcmpCloseHandle IcmpSendEcho IcmpCreateFile

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_8a3fc153dee8565dcdbd45c76a1d2b0e_elex_remcos_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

ws2_32

psapi

iphlpapi

version

generic