2026-08-10_4a3427b970aa551f585d8d8b381d7c01_elex_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_4a3427b970aa551f585d8d8b381d7c01_elex_remcos_stop
Size 448KB
Sample260810-c6s4datwew
SHA256 a4b3e09ecb74c8989de879d108d58ceaefb848200170049000563107a2b05845
MD5 4a3427b970aa551f585d8d8b381d7c01
SHA1 ce380e54db8b8527ce34079819f8356bd2068df2
SHA512 753b89427122caa701e3357f23652991e0dba8fdfa1276129f51737de182c794ea45e2794c012e2511befb79b0234858fc46dd9053bd51c385214a6841bc41b1
SSDEEP 6144:rQmWF/13f/S3k9Fsfsb8LwKrbLAfZRNFR+:rNM9Fs0jKr3oZ
TLSH
T1CEA47C02FBD6C032E95701B11D1183AE9A7EF84A2B75C7D7EBC05E1E99302D2DAB5319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_4a3427b970aa551f585d8d8b381d7c01_elex_remcos_stop

File Explorer

2026-08-10_4a3427b970aa551f585d8d8b381d7c01_elex_remcos_stop

.exe 448KB

2026-08-10_4a3427b970aa551f585d8d8b381d7c01_elex_remcos_stop

IMPHASH 1f7c7353ad354bc92e900128176ac913
SHA256 a4b3e09ecb74c8989de879d108d58ceaefb848200170049000563107a2b05845
MD5 4a3427b970aa551f585d8d8b381d7c01
SHA1 ce380e54db8b8527ce34079819f8356bd2068df2
SHA512 753b89427122caa701e3357f23652991e0dba8fdfa1276129f51737de182c794ea45e2794c012e2511befb79b0234858fc46dd9053bd51c385214a6841bc41b1
SSDEEP 6144:rQmWF/13f/S3k9Fsfsb8LwKrbLAfZRNFR+:rNM9Fs0jKr3oZ
TLSH
T1CEA47C02FBD6C032E95701B11D1183AE9A7EF84A2B75C7D7EBC05E1E99302D2DAB5319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

117309

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\b_xpd6.2.3\xpd.03\xpd.core\lwp\build\xpd-core-native\eclipse\plugins\com.ibm.pvc.wct.mgmtservice.com\src\win32\msvisualstudio\mgmtservice\rcplauncher\release\rcplauncher.pdb

netapi32

NetUserGetLocalGroups NetApiBufferFree

kernel32

CreateToolhelp32Snapshot WaitForSingleObject GetExitCodeProcess CreateProcessW CloseHandle WriteFile CreateFileW WaitNamedPipeW SetDllDirectoryW GetCommandLineW GetVersionExW CreateDirectoryW CopyFileW GetModuleFileNameW GetFullPathNameW FreeLibrary GetProcAddress LoadLibraryW Process32FirstW FindNextFileW DeleteFileW RemoveDirectoryW FindFirstFileW MoveFileExW OpenProcess GetCurrentProcess OutputDebugStringW LocalFree FormatMessageW CompareStringW CompareStringA GetLocaleInfoW WriteConsoleW GetConsoleOutputCP WriteConsoleA CreateFileA IsValidLocale Process32NextW GetConsoleTitleW GetCurrentProcessId GetTickCount SetConsoleTitleW Sleep OpenSemaphoreW GetLastError GetDriveTypeA FindClose UnhandledExceptionFilter EnumSystemLocalesA GetUserDefaultLCID InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoW GetSystemTimeAsFileTime TerminateProcess SetEndOfFile SetUnhandledExceptionFilter IsDebuggerPresent RaiseException HeapReAlloc RtlUnwind SetEnvironmentVariableW GetModuleHandleA ExitProcess GetTimeZoneInformation WideCharToMultiByte FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW LockFile UnlockFile DeleteFileA LCMapStringA MultiByteToWideChar LCMapStringW GetCPInfo GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter VirtualAlloc HeapSize GetACP GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryA SetFilePointer GetCurrentDirectoryA SetStdHandle SetEnvironmentVariableA ReadFile GetLocaleInfoA GetStringTypeA GetStringTypeW

user32

ExitWindowsEx ShowWindow wsprintfW FindWindowW WaitForInputIdle

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey AllocateAndInitializeSid LookupAccountSidW FreeSid GetUserNameW OpenProcessToken

shell32

CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_4a3427b970aa551f585d8d8b381d7c01_elex_remcos_stop

netapi32

kernel32

user32

advapi32

shell32

generic