2026-08-09_4e2f64599e20e88118c59b2e0fe64b7f_elex_floxif_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_4e2f64599e20e88118c59b2e0fe64b7f_elex_floxif_remcos_stop
Size 577KB
Sample260809-hm64sasfpd
SHA256 bcb0a16a3a046bbea284ae5b940aed11dea04f3922953dd1ebce14b766a79873
MD5 4e2f64599e20e88118c59b2e0fe64b7f
SHA1 7cc9081d3e5de40b1df22684c955903b0e19ae05
SHA512 4ca9fe9caf31e924f83b882a36eecdec15fde4ff50a3b9473c79a2b1fd000059c82379f7e9793a628cbb48c6c1a85d1fb7da79a3a8f9551680b36827c0f73a99
SSDEEP 12288:Rcw74b9EiW+Ec33Kbs/vxvGRzSpBjvrEH7H:TiW+EcKbs/vxvR3rEH7H
TLSH
T185C49E01F3AAD2F4C0A50231151B8B3A66B2BD26931586C7B7D0EFAE9E397C1D63534D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-09_4e2f64599e20e88118c59b2e0fe64b7f_elex_floxif_remcos_stop

File Explorer

2026-08-09_4e2f64599e20e88118c59b2e0fe64b7f_elex_floxif_remcos_stop

.exe 577KB

2026-08-09_4e2f64599e20e88118c59b2e0fe64b7f_elex_floxif_remcos_stop

IMPHASH 164a3bcb97e9b0f25b823660c63a24a7
SHA256 bcb0a16a3a046bbea284ae5b940aed11dea04f3922953dd1ebce14b766a79873
MD5 4e2f64599e20e88118c59b2e0fe64b7f
SHA1 7cc9081d3e5de40b1df22684c955903b0e19ae05
SHA512 4ca9fe9caf31e924f83b882a36eecdec15fde4ff50a3b9473c79a2b1fd000059c82379f7e9793a628cbb48c6c1a85d1fb7da79a3a8f9551680b36827c0f73a99
SSDEEP 12288:Rcw74b9EiW+Ec33Kbs/vxvGRzSpBjvrEH7H:TiW+EcKbs/vxvR3rEH7H
TLSH
T185C49E01F3AAD2F4C0A50231151B8B3A66B2BD26931586C7B7D0EFAE9E397C1D63534D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

7b:0d:a9:53:c4:f2:78:0c:76:ba:7b:14:c1:4f:83:cb:52:30:fc:b0

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 25, 2008

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0f:78:4d:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 23, 2007 - Feb 23, 2009

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:14:2c:a7:00:00:00:00:00:06

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 12, 2007 - Jun 13, 2012

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Minor OS version

Major OS version

Entry point

153418

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Src\Autoruns\Release\autorunsc.pdb

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

comctl32

ImageList_ReplaceIcon ImageList_Add

ws2_32

WSCGetProviderPath WSAStartup WSCEnumProtocols

kernel32

GetTimeFormatA GetDateFormatA FileTimeToSystemTime FileTimeToLocalFileTime GetFileTime GetFileSize CreateProcessA MultiByteToWideChar LeaveCriticalSection ExitThread SetErrorMode TlsAlloc InterlockedIncrement InterlockedDecrement SearchPathA GetPrivateProfileStringA FreeLibrary LoadLibraryExA WritePrivateProfileStringA FindClose FindNextFileA LocalFree CreateFileMappingA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle IsValidLocale EnumSystemLocalesA GetUserDefaultLCID InterlockedExchange SetConsoleCtrlHandler InitializeCriticalSection FormatMessageA GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA FlushFileBuffers Sleep GetStringTypeW GetStringTypeA MapViewOfFile UnmapViewOfFile GetFileAttributesA lstrcpyA GetVersion GetModuleHandleA lstrcmpA LocalAlloc lstrlenA CreateFileA ReadFile SetFilePointer GetWindowsDirectoryA ExpandEnvironmentStringsA SetEnvironmentVariableA TlsSetValue LoadLibraryA GetProcAddress SetLastError GetLocaleInfoA GetNumberFormatA GetModuleFileNameA GetCurrentProcess GetLastError CloseHandle WideCharToMultiByte TlsGetValue GetLocaleInfoW GetTimeZoneInformation SetEndOfFile CompareStringA GetStdHandle GetSystemTimeAsFileTime WriteFile CompareStringW GetCurrentThreadId GetCurrentThread FindFirstFileA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount LCMapStringW LCMapStringA IsValidCodePage TlsFree HeapSize ExitProcess HeapCreate HeapDestroy VirtualAlloc VirtualFree FatalAppExitA DeleteCriticalSection GetOEMCP GetACP HeapFree GetProcessHeap lstrlenW HeapAlloc HeapReAlloc RtlUnwind EnterCriticalSection TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException GetCommandLineA GetVersionExA GetCPInfo

user32

SetWindowTextA SetCursor SendMessageA CheckMenuItem LoadCursorA LoadStringA DialogBoxIndirectParamA GetSysColorBrush EndDialog InflateRect TrackPopupMenu EnableMenuItem GetDlgItem SetDlgItemTextA DestroyIcon LoadIconA ShowWindow GetMenu DeleteMenu GetSubMenu InsertMenuA

gdi32

GetDeviceCaps SetMapMode StartDocA StartPage EndPage EndDoc DeleteObject

comdlg32

PrintDlgA

advapi32

RegQueryValueExA OpenSCManagerA OpenServiceA CloseServiceHandle CryptAcquireContextA CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash CryptReleaseContext RegCreateKeyA RegSetValueExA RegEnumValueA RegQueryInfoKeyA RegEnumKeyA RegQueryValueA RegLoadKeyA RegUnLoadKeyA LookupAccountSidA AllocateAndInitializeSid GetTokenInformation EqualSid FreeSid OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegCloseKey

shell32

SHGetFileInfoA ShellExecuteA

ole32

CoUninitialize CoTaskMemFree CoInitialize CoCreateInstance

oleaut32

VariantChangeType VariantClear VariantInit SysStringByteLen SysAllocStringByteLen SysFreeString SysStringLen SysAllocString CreateErrorInfo GetErrorInfo SetErrorInfo

shlwapi

UrlUnescapeA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_4e2f64599e20e88118c59b2e0fe64b7f_elex_floxif_remcos_stop

PE Signature issue

version

comctl32

ws2_32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

generic