2026-08-12_c121e1f5c5b5126db0e035c98d8768df_elex_maze_remcos_stealc

General

Target
2026-08-12_c121e1f5c5b5126db0e035c98d8768df_elex_maze_remcos_stealc
Size 892KB
Sample260812-ysakrsssev
SHA256 2958b1348166d6842cd9e75400fa2c071d11ad0950ed8b0c6472cb16fa11d3a0
MD5 c121e1f5c5b5126db0e035c98d8768df
SHA1 b1c8d14022dd1e2aeb2b82167b15b559ad935c5f
SHA512 a48bff4406ed227d832f3072a879b439088629a2a22f9a4c99d0c72377b5203643287ce72e7d24b60ad8f064e67b5dfc2f1cdba96616a079b466a6290807af27
SSDEEP 24576:QWRVGytePu7+ATkzlUXnu62wxvAtR23+JO:jteWeUXu7w+Go
TLSH
T12015CF303714C67ED96228F14EBDD9AF155CA905476158C3A7C82F5EAEB02E32B3472B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_c121e1f5c5b5126db0e035c98d8768df_elex_maze_remcos_stealc

File Explorer

2026-08-12_c121e1f5c5b5126db0e035c98d8768df_elex_maze_remcos_stealc

.exe 892KB

2026-08-12_c121e1f5c5b5126db0e035c98d8768df_elex_maze_remcos_stealc

IMPHASH 8043a70c3d806c342d98a7920f3252e0
SHA256 2958b1348166d6842cd9e75400fa2c071d11ad0950ed8b0c6472cb16fa11d3a0
MD5 c121e1f5c5b5126db0e035c98d8768df
SHA1 b1c8d14022dd1e2aeb2b82167b15b559ad935c5f
SHA512 a48bff4406ed227d832f3072a879b439088629a2a22f9a4c99d0c72377b5203643287ce72e7d24b60ad8f064e67b5dfc2f1cdba96616a079b466a6290807af27
SSDEEP 24576:QWRVGytePu7+ATkzlUXnu62wxvAtR23+JO:jteWeUXu7w+Go
TLSH
T12015CF303714C67ED96228F14EBDD9AF155CA905476158C3A7C82F5EAEB02E32B3472B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

197934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\xyf\web\xyf2\Release\XyfSubProcess.pdb

libcef

cef_v8value_create_function cef_v8context_get_current_context cef_process_message_create cef_string_list_size cef_string_list_value cef_string_list_append cef_string_map_size cef_string_map_key cef_string_map_value cef_string_map_append cef_string_multimap_size cef_string_multimap_key cef_string_multimap_value cef_v8value_create_int cef_string_list_clear cef_string_multimap_alloc cef_string_multimap_free cef_v8value_create_bool cef_command_line_create cef_string_map_free cef_string_map_alloc cef_log cef_api_hash cef_execute_process cef_string_list_free cef_string_list_alloc cef_string_userfree_utf16_free cef_string_utf16_cmp cef_string_utf8_to_utf16 cef_string_utf8_clear cef_string_utf16_to_utf8 cef_string_utf16_set cef_string_multimap_append cef_string_utf16_clear

kernel32

CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle SetFilePointerEx GetConsoleMode GetCommandLineW GetLastError SetLastError GetConsoleCP OutputDebugStringW LoadLibraryExW HeapReAlloc GetOEMCP GetACP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter WriteFile GetModuleFileNameW GetFileType GetStdHandle GetProcessHeap GetCurrentThreadId HeapSize GetModuleHandleExW ExitProcess LCMapStringW GetProcAddress GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess Sleep InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter HeapAlloc GetCPInfo RaiseException RtlUnwind HeapFree IsProcessorFeaturePresent IsDebuggerPresent GetStringTypeW MultiByteToWideChar DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection WideCharToMultiByte CloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_c121e1f5c5b5126db0e035c98d8768df_elex_maze_remcos_stealc

libcef

kernel32

generic