2026-08-13_fd523c522aab9b80d72ec6daa131a65f_elex_mespinoza_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_fd523c522aab9b80d72ec6daa131a65f_elex_mespinoza_virut
Size 719KB
Sample260813-v8625avfle
SHA256 a06e8b9f9eaf3721558edcd12013455596b323535aa5edb607b5d3506c7199e1
MD5 fd523c522aab9b80d72ec6daa131a65f
SHA1 fd1255594802e7ddbdfe6292e79e975dda72204f
SHA512 3ca9d4b4cb2d283de183b9e32b6d1b9708b89277d1a89a8e01ee5b04d5268be9f0860adb3434db2afd34ab4b807c746009199e83ae5fa8a9ee7fe1bc9ec81e27
SSDEEP 12288:OMl2tXkk8a0Y6HjGr1WqJ1BfJJsxGhf7:jvkkAr1WqJvfJJsxGhf7
TLSH
T1DAF46C60B744CC39E9E101B28F78DA7E846DEFA45B7340D7AA88395D3D356C21A31F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-13_fd523c522aab9b80d72ec6daa131a65f_elex_mespinoza_virut

File Explorer

2026-08-13_fd523c522aab9b80d72ec6daa131a65f_elex_mespinoza_virut

.exe 719KB

2026-08-13_fd523c522aab9b80d72ec6daa131a65f_elex_mespinoza_virut

IMPHASH 9b279691b6c9006a502e3384ed6ed37b
SHA256 a06e8b9f9eaf3721558edcd12013455596b323535aa5edb607b5d3506c7199e1
MD5 fd523c522aab9b80d72ec6daa131a65f
SHA1 fd1255594802e7ddbdfe6292e79e975dda72204f
SHA512 3ca9d4b4cb2d283de183b9e32b6d1b9708b89277d1a89a8e01ee5b04d5268be9f0860adb3434db2afd34ab4b807c746009199e83ae5fa8a9ee7fe1bc9ec81e27
SSDEEP 12288:OMl2tXkk8a0Y6HjGr1WqJ1BfJJsxGhf7:jvkkAr1WqJvfJJsxGhf7
TLSH
T1DAF46C60B744CC39E9E101B28F78DA7E846DEFA45B7340D7AA88395D3D356C21A31F16
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

04:fa:57:42:51:36:00:2e:40:f4:8d:89:88:4c:29:32:b9:05:35:09:15:c4:d8:fc:ae:e9:e8:aa:2f:a6:fe:04

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Chains

Dec 25, 2024

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

bf:65:5c:a5:34:d5:e4:12:0c:ed:58:70:41:8b:80:79:c3:03:0f:53

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Chains

Dec 25, 2024

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Serial Number

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 2, 2023 - Oct 30, 2034

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Beijing Duyou Science and Technology Co.\,Ltd.,O=Beijing Duyou Science and Technology Co.\,Ltd.,ST=Beijing,C=CN

Serial Number

0d:6a:73:d0:15:d3:84:9c:e5:43:01:d1:77:5c:08:f4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 20, 2023 - Oct 22, 2026

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

754369

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\baidu\netdisk\pc-yunbrowser\output\BaiduNetdiskHost.pdb

bull140u

?AssertOut@BULL@@YAJPB_WH_N0@Z ?XLogV@BULL@@YAXIPB_W0PAD@Z ?MultiByteToWideChar@BULL@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@IPBD@Z ?GetLogController@BULL@@YAJPAPAUILogController@1@@Z ?EnableNamedObject@BULL@@YAJPA_WABU_GUID@@@Z ?CreateObjectNative@BULL@@YAJABU_GUID@@0PAPAX@Z ?WideCharToMultiByte@BULL@@YA?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@IPB_W@Z

kernel32

SetUnhandledExceptionFilter GetModuleHandleW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetVersionExW GetCurrentProcessId CreateToolhelp32Snapshot Thread32First OpenThread SuspendThread CloseHandle Thread32Next GetThreadContext CreateProcessW WaitForSingleObject UnmapViewOfFile CreateFileMappingW MapViewOfFile HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW LoadLibraryW GetProcAddress FreeLibrary EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetLastError RaiseException DecodePointer InitializeCriticalSectionAndSpinCount WideCharToMultiByte SetLastError MultiByteToWideChar GetTempPathW SetErrorMode Sleep SetEvent ResetEvent CreateEventW WaitForMultipleObjects QueryPerformanceCounter GetSystemTimeAsFileTime CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus TlsAlloc TlsGetValue TlsSetValue TlsFree OpenProcess CreateMutexW AllocConsole GetStdHandle GetConsoleScreenBufferInfo FreeConsole SetConsoleTextAttribute WriteConsoleW OutputDebugStringW GetSystemTime GetModuleFileNameW GetPrivateProfileIntW DeleteFileW CreateFileW GetFileSize ReadFile CreateDirectoryW WriteFile EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA VirtualProtect IsDebuggerPresent WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW DuplicateHandle ConnectNamedPipe CreateNamedPipeW CancelIo RegisterWaitForSingleObject UnregisterWaitEx CreateThread GetNamedPipeInfo

user32

SetWindowLongW KillTimer GetWindowLongW UnregisterClassW DefWindowProcW CallWindowProcW CreateWindowExW DestroyWindow PostMessageW IsWindow GetClassInfoExW RegisterClassExW PeekMessageW TranslateMessage DispatchMessageW WaitMessage PostQuitMessage CallMsgFilterW GetQueueStatus LoadCursorW MsgWaitForMultipleObjectsEx SetTimer

shell32

CommandLineToArgvW SHGetSpecialFolderPathW SHGetFolderPathW SHCreateDirectoryExW

ole32

CoCreateInstance StringFromCLSID CoCreateGuid CoTaskMemFree

oleaut32

SysAllocStringByteLen SysStringByteLen SysAllocStringLen VarBstrCmp SysAllocString SysStringLen VariantClear VariantInit SysFreeString

msvcp140

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ

dbghelp

SymGetModuleBase StackWalk SymInitialize SymFunctionTableAccess SymCleanup

apputil

?TransformWStringToUtf8String@Misc@AppUtil@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@4@@Z ?TransformUtf8StringToWString@Misc@AppUtil@@YAJV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@AAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@4@@Z

winmm

timeGetTime timeBeginPeriod timeEndPeriod

wininet

InternetReadFile InternetQueryDataAvailable HttpQueryInfoA HttpEndRequestA InternetWriteFile HttpSendRequestExA HttpAddRequestHeadersA HttpOpenRequestA InternetConnectA InternetSetOptionA InternetOpenA InternetCloseHandle

vcruntime140

_purecall _CxxThrowException __CxxFrameHandler3 memcpy memset memchr wcschr strstr __vcrt_InitializeCriticalSectionEx _except_handler4_common __std_exception_copy __std_exception_destroy wcsstr wcsrchr __std_terminate memmove __RTDynamicCast

api-ms-win-crt-string-l1-1-0

strnlen isspace wcsnlen wmemcpy_s _wcslwr_s wcsncpy_s _wcsicmp wcscpy_s

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _invalid_parameter_noinfo_noreturn _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _errno _c_exit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo _controlfp_s

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswprintf __stdio_common_vsnwprintf_s _wfsopen fclose __stdio_common_vsprintf_s __stdio_common_vfwprintf fflush __stdio_common_vswprintf_s __stdio_common_vsprintf_p

api-ms-win-crt-convert-l1-1-0

atoi _wtoi _wtoi64

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _recalloc realloc _callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil _except1

api-ms-win-crt-time-l1-1-0

wcsftime _time64 _localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_waccess

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-utility-l1-1-0

rand_s

Name

.text

Size

262KB

Virtual Size

261KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

213KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_fd523c522aab9b80d72ec6daa131a65f_elex_mespinoza_virut

PE Signature issue

PE Signature issue

bull140u

kernel32

user32

shell32

ole32

oleaut32

msvcp140

dbghelp

apputil

winmm

wininet

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic