2026-08-08_4c9708b43dba6e17532c2ca50f3508e7_elex_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_4c9708b43dba6e17532c2ca50f3508e7_elex_stop
Size 623KB
Sample260808-wjsnwabl5t
SHA256 bdff05da6b1f8c6f62ac8ec08582db5c6496dcc571d92c1511a573530480afa8
MD5 4c9708b43dba6e17532c2ca50f3508e7
SHA1 6e34c24de736bcff7a568191e7d21dcb61b0b4aa
SHA512 a21acf94f278d6284a954410d225330f5322a9ae299cdd443f769b522af2ef1156478877673814a70109310f75376a9d0327da92037c6179b92e7e4e214ae4fd
SSDEEP 12288:mMl23+mvm27FPL/Nr5IpNL9KEiLQXCsqn6eVhFnvtdn7DnQemX4Km:mMl23+mmzKvLQXCs+6eVhFvuX4Km
TLSH
T158D4BF1279D08337E24652BA8B13CB6B1AB77CF41468944BB9D036B93E34352E72875F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_4c9708b43dba6e17532c2ca50f3508e7_elex_stop

File Explorer

2026-08-08_4c9708b43dba6e17532c2ca50f3508e7_elex_stop

.exe 623KB

2026-08-08_4c9708b43dba6e17532c2ca50f3508e7_elex_stop

IMPHASH bc4e243c863a6cf55692099ebe0e56f7
SHA256 bdff05da6b1f8c6f62ac8ec08582db5c6496dcc571d92c1511a573530480afa8
MD5 4c9708b43dba6e17532c2ca50f3508e7
SHA1 6e34c24de736bcff7a568191e7d21dcb61b0b4aa
SHA512 a21acf94f278d6284a954410d225330f5322a9ae299cdd443f769b522af2ef1156478877673814a70109310f75376a9d0327da92037c6179b92e7e4e214ae4fd
SSDEEP 12288:mMl23+mvm27FPL/Nr5IpNL9KEiLQXCsqn6eVhFnvtdn7DnQemX4Km:mMl23+mmzKvLQXCs+6eVhFvuX4Km
TLSH
T158D4BF1279D08337E24652BA8B13CB6B1AB77CF41468944BB9D036B93E34352E72875F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

215465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\360Game\trunk\src\release\sesvc.pdb

kernel32

Sleep TerminateThread SuspendThread WaitForSingleObject SystemTimeToFileTime SetEndOfFile TlsFree TlsAlloc TlsSetValue IsBadWritePtr IsBadReadPtr WriteFile SetFileTime ResetEvent GetTickCount CreateEventW SetWaitableTimer CreateWaitableTimerW GetDiskFreeSpaceExW GetTempFileNameW CancelWaitableTimer WaitForMultipleObjects GetShortPathNameW CreateDirectoryW SearchPathW FindClose FindNextFileW FindFirstFileW RemoveDirectoryW SetFileAttributesW GetFileAttributesW DeviceIoControl GetVersionExW MoveFileExW lstrcmpA SetLastError TerminateProcess OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot GetCommandLineW GetPrivateProfileIntW WritePrivateProfileStringW ExpandEnvironmentStringsW GetModuleHandleA SetProcessWorkingSetSize ExitProcess GlobalUnlock GlobalLock GlobalFree SetEvent VirtualQuery FileTimeToLocalFileTime GetFileTime LoadLibraryExW SetErrorMode HeapFree HeapAlloc GetProcessHeap DuplicateHandle GetWindowsDirectoryW GetSystemInfo OutputDebugStringW GetSystemTimeAsFileTime GetPrivateProfileStringW CompareStringW CompareStringA GetLocaleInfoW CreateFileA LoadLibraryA InterlockedExchange SetConsoleCtrlHandler InitializeCriticalSectionAndSpinCount WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetStringTypeW GetStringTypeA GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA SetStdHandle HeapReAlloc FatalAppExitA HeapDestroy HeapCreate DeleteCriticalSection GetFileType GetStdHandle SetHandleCount GetCurrentProcess GlobalAlloc InterlockedIncrement DebugBreak InterlockedDecrement GetLastError ReadFile SetFilePointer VirtualAlloc VirtualFree FindResourceW LoadResource MultiByteToWideChar SizeofResource DeleteFileW FreeLibrary GetTempPathW GetModuleFileNameW GetSystemDirectoryW CopyFileW CreateFileW GetFileSize CreateFileMappingW MapViewOfFile GetCurrentThread lstrlenW lstrlenA UnmapViewOfFile GetModuleHandleW LoadLibraryW GetTimeZoneInformation HeapSize GetConsoleMode GetConsoleCP LeaveCriticalSection EnterCriticalSection LCMapStringW LCMapStringA TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo GetStartupInfoA GetCommandLineA CreateThread GetCurrentThreadId ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind RaiseException GetProcAddress CloseHandle WideCharToMultiByte GetProcessTimes SetEnvironmentVariableA

user32

GetDesktopWindow FillRect SetRect InvalidateRect wvsprintfW CharNextW SetWindowPos GetSystemMetrics GetWindowRect GetParent SendMessageW FindWindowW ReleaseDC DrawTextW GetDC GetKeyNameTextW MapVirtualKeyW CloseClipboard GetClipboardData OpenClipboard IsClipboardFormatAvailable SetClipboardData EmptyClipboard CopyRect GetMonitorInfoW MonitorFromWindow MonitorFromPoint ShowWindow DispatchMessageW TranslateMessage GetWindowThreadProcessId PostQuitMessage FindWindowExW SubtractRect PeekMessageW

gdi32

DeleteObject CreateSolidBrush

advapi32

RegDeleteKeyW LookupPrivilegeValueW OpenProcessToken FreeSid GetSidIdentifierAuthority GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation CopySid RegSetKeySecurity RegQueryInfoKeyW RegEnumKeyW GetLengthSid InitializeAcl AddAce InitializeSecurityDescriptor SetSecurityDescriptorDacl RegGetKeySecurity RegEnumKeyExW RegDeleteValueW RegOpenKeyExW RegCloseKey RegQueryValueExW AllocateAndInitializeSid CheckTokenMembership AdjustTokenPrivileges

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetSpecialFolderPathW SHFreeNameMappings SHFileOperationW ord680 ShellExecuteExW ShellExecuteW SHAppBarMessage SHGetSpecialFolderLocation SHGetFileInfoW

ole32

CoTaskMemFree OleInitialize OleUninitialize CoUninitialize CoCreateInstance CoInitialize

oleaut32

SysAllocString SysFreeString

shlwapi

PathFindFileNameA PathGetDriveNumberW PathFindExtensionW PathAppendW SHSetValueW StrCmpIW PathFindFileNameW PathFileExistsW PathRemoveFileSpecW SHGetValueW PathIsRootW PathCombineW StrStrIW PathIsURLW StrStrIA

wininet

InternetCrackUrlW HttpQueryInfoW FtpGetFileSize FtpCommandW InternetGetLastResponseInfoW InternetSetOptionA InternetConnectW InternetSetStatusCallbackW InternetOpenW InternetSetOptionW HttpSendRequestExW HttpOpenRequestW InternetQueryOptionW InternetCloseHandle InternetWriteFile InternetReadFileExA InternetReadFile HttpEndRequestW FtpOpenFileW

psapi

GetModuleFileNameExW EnumProcessModules

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

setupapi

SetupIterateCabinetW

comctl32

ImageList_Remove ImageList_Duplicate InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_4c9708b43dba6e17532c2ca50f3508e7_elex_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

psapi

version

setupapi

comctl32

generic