2026-08-14_51473870c5c61809a69c364522cf7bd2_elex_mespinoza_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_51473870c5c61809a69c364522cf7bd2_elex_mespinoza_remcos
Size 994KB
Sample260814-e3ywkavclf
SHA256 978ed282dbe066f6bc4b318908db4866c9fd5cbf6cc6274436d78580f9f149ba
MD5 51473870c5c61809a69c364522cf7bd2
SHA1 f06d42ecdb5ea03f034afed9bed20684322a671f
SHA512 b1bfd43e545f96d2e8bede621f679676a73979bc169658e921abac0b7101f863d353a68a8137acb37ee2acb9875be1d77a2baee9a13afc518fe87cb041da6d93
SSDEEP 24576:el48iOw1smBwiDWswxNiL5LEssasss5sssssgssssssOsssssssSssssss3ssss5:wKt1OiDWsw7+x
TLSH
T1E3257D6377A4A1B3D13A82F2AE0DC5BF5AE5EC30263D151B37C6B65C2E728500627937
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-14_51473870c5c61809a69c364522cf7bd2_elex_mespinoza_remcos

.exe 994KB

2026-08-14_51473870c5c61809a69c364522cf7bd2_elex_mespinoza_remcos

IMPHASH 736c7a487b86e14cab6263daf2deae43
SHA256 978ed282dbe066f6bc4b318908db4866c9fd5cbf6cc6274436d78580f9f149ba
MD5 51473870c5c61809a69c364522cf7bd2
SHA1 f06d42ecdb5ea03f034afed9bed20684322a671f
SHA512 b1bfd43e545f96d2e8bede621f679676a73979bc169658e921abac0b7101f863d353a68a8137acb37ee2acb9875be1d77a2baee9a13afc518fe87cb041da6d93
SSDEEP 24576:el48iOw1smBwiDWswxNiL5LEssasss5sssssgssssssOsssssssSssssss3ssss5:wKt1OiDWsw7+x
TLSH
T1E3257D6377A4A1B3D13A82F2AE0DC5BF5AE5EC30263D151B37C6B65C2E728500627937
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

76:d0:35:67:fc:66:b1:f6:91:34:e3:df:e4:41:36:62:42:41:5e:0c:79:d3:a8:f1:b3:44:00:f8:06:ef:31:1d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=76195629,CN=Hong Kong master science and technology Limited,O=Hong Kong master science and technology Limited,L=Hong Kong,C=HK,1.3.6.1.4.1.311.60.2.1.3=#1302484b,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Aug 10, 2026

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

Serial Number

64:47:66:bb:43:72:52:c3:13:70:b8:af:26:66:47:ee

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 18, 2026 - May 18, 2027

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Minor OS version

Major OS version

Entry point

378779

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\jekins_work\workspace\wmastercleanup_build\product\win32\dbginfo\wmoptool.pdb

kernel32

SetEvent ResetEvent GetModuleHandleW InterlockedIncrement InterlockedDecrement FreeResource GlobalAlloc GlobalLock GlobalUnlock GlobalFree OutputDebugStringW LocalFree InterlockedExchange OpenMutexW GetLocaleInfoW GetUserDefaultLCID GetVersionExW OutputDebugStringA lstrcmpiW LoadLibraryExW OpenEventW lstrcatW HeapDestroy GetCurrentProcess CreateEventW lstrlenW HeapAlloc LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList EncodePointer InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetFileSize WideCharToMultiByte SystemTimeToFileTime CreateDirectoryW GetCurrentDirectoryW CloseHandle LocalFileTimeToFileTime MultiByteToWideChar WaitForMultipleObjects GetTickCount GetCurrentProcessId DecodePointer GetLocalTime RaiseException Sleep GetCurrentThreadId WaitForSingleObject CreateMutexW SetEndOfFile InitializeCriticalSectionAndSpinCount SetLastError GetProcAddress LoadLibraryW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection FreeLibrary GetLastError GetModuleFileNameW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetWindowsDirectoryW GetProcessHeap GetFileAttributesW CreateFileW SetFilePointer SetFileTime WriteFile HeapFree HeapReAlloc HeapSize ReadFile

user32

TranslateMessage PeekMessageW DispatchMessageW PostThreadMessageW UnregisterClassW GetWindowLongW GetClientRect IsDialogMessageW IsRectEmpty GetNextDlgTabItem GetCursorPos MonitorFromWindow GetMonitorInfoW IsWindow SetWindowRgn IsChild GetFocus SetFocus ClientToScreen ScreenToClient IntersectRect UpdateLayeredWindow CallWindowProcW IsIconic SetForegroundWindow EqualRect DrawFrameControl OffsetRect SetRectEmpty DrawIconEx GetDlgItem IsWindowVisible ShowWindow DestroyIcon LoadIconW EndPaint BeginPaint SetCursor PtInRect GetDlgCtrlID ReleaseCapture SetCapture DrawTextW SetRect SendMessageTimeoutW FindWindowExW CharNextW MapWindowPoints GetWindow GetClassInfoExW SetActiveWindow SystemParametersInfoW EnableWindow GetActiveWindow PostMessageW AttachThreadInput GetWindowThreadProcessId GetForegroundWindow LoadBitmapW MoveWindow RegisterWindowMessageW DestroyWindow IsWindowEnabled InvalidateRect LoadImageW InflateRect SendMessageW FindWindowW DefWindowProcW LoadCursorW RegisterClassExW CreateWindowExW CopyRect GetWindowRect GetMessageW SetTimer KillTimer GetParent GetDesktopWindow GetDC ReleaseDC SetWindowPos SetWindowLongW

gdi32

DeleteObject CreateCompatibleDC SelectObject SetBkColor ExtTextOutW CreateDIBSection GetObjectW SetTextColor BitBlt StretchBlt CreateBitmap CreateCompatibleBitmap GetDeviceCaps GetStockObject CreatePen SetStretchBltMode GetStretchBltMode RestoreDC SelectClipRgn SaveDC CreateRectRgn Rectangle SetBkMode CreateFontIndirectW MoveToEx LineTo GetTextColor GetCurrentObject RectInRegion TextOutW GetTextExtentPoint32W CreateRectRgnIndirect GetClipRgn RoundRect CreateRoundRectRgn ExtSelectClipRgn OffsetRgn GetViewportOrgEx CombineRgn SetViewportOrgEx GetTextMetricsW DeleteDC

advapi32

GetSecurityDescriptorSacl RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW SetSecurityDescriptorSacl RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey RegOpenKeyW InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteValueW

shell32

ord680 ShellExecuteExW ShellExecuteW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CreateStreamOnHGlobal CoUninitialize CoInitialize

oleaut32

VarUI4FromStr SysFreeString

shlwapi

PathIsDirectoryW PathRemoveFileSpecW PathFindFileNameW PathAppendW PathFileExistsW PathAddBackslashW StrToIntW StrToIntA

comctl32

InitCommonControlsEx DrawShadowText _TrackMouseEvent

msimg32

AlphaBlend

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

gdiplus

GdipSetStringFormatLineAlign GdipGetImageGraphicsContext GdipGraphicsClear GdipGetImagePixelFormat GdipAddPathPieI GdipSetStringFormatFlags GdipDrawImageRectI GdipDeleteBrush GdipCloneBrush GdipSetStringFormatTrimming GdipImageRotateFlip GdipSetTextRenderingHint GdipCreateBitmapFromScan0 GdipSetInterpolationMode GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipCreateFont GdipCreateFontFromLogfontW GdipDrawImageRectRect GdipDrawImagePointsRectI GdipCloneFontFamily GdipCreateSolidFill GdipGetFontCollectionFamilyList GdipFillRectangleI GdipGetFontCollectionFamilyCount GdipResetWorldTransform GdipRotateWorldTransform GdipPrivateAddFontFile GdipCreateImageAttributes GdipDisposeImageAttributes GdipDeletePrivateFontCollection GdipSetImageAttributesColorMatrix GdipTranslateWorldTransform GdipSetClipPath GdipSetSmoothingMode GdipClosePathFigure GdipStartPathFigure GdipAddPathLineI GdipFillPath GdipAddPathRectangleI GdipDrawRectangleI GdipAddPathArcI GdipGetImageHeight GdipDrawPath GdipFillRectangle GdipSetPenStartCap GdipSetPenEndCap GdipSetPenDashStyle GdipDrawLine GdipCreateLineBrushFromRectWithAngleI GdipScaleWorldTransform GdipDeletePen GdipCreateFromHDC GdipDeleteGraphics GdipDrawLinesI GdipCreatePen1 GdipNewPrivateFontCollection GdipDrawImageRectRectI GdipMeasureString GdipCreatePath GdipDeletePath GdipGetImageWidth GdipSetStringFormatAlign GdipDeleteFontFamily GdipCloneBitmapArea GdipDeleteFont GdipLoadImageFromFile GdiplusShutdown GdiplusStartup GdipLoadImageFromStream GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipCloneImage GdipCreateBitmapFromStream GdipFree GdipAlloc GdipSetPenMode

vcruntime140

__RTDynamicCast _local_unwind4 wcsstr memset __std_terminate memmove wcschr wcsrchr _purecall memcmp strchr __vcrt_InitializeCriticalSectionEx __std_exception_copy __std_exception_destroy _CxxThrowException _except_handler4_common __CxxFrameHandler3 memcpy

api-ms-win-crt-heap-l1-1-0

malloc free realloc _recalloc _callnewh calloc _set_new_mode

api-ms-win-crt-string-l1-1-0

strncmp wcspbrk wmemcpy_s wcscmp _wcslwr_s wcsnlen wcslen strncat_s _stricmp strcat_s _wcsicmp wcscpy_s _wcsupr_s __isascii iscntrl isspace isalnum isalpha strnlen wcscspn wcsspn strncpy_s isdigit strlen isgraph wcsncmp wcsncpy_s wcsncpy strcmp isprint ispunct isxdigit isupper islower toupper wcscat wcscat_s tolower strcpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf _wfopen __stdio_common_vsscanf fread fopen_s __stdio_common_vsnprintf_s __stdio_common_vfprintf fseek fclose ferror fputc ftell __stdio_common_vswprintf __stdio_common_vswprintf_s _set_fmode __stdio_common_vsprintf_s __p__commode

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo _register_thread_local_exe_atexit_callback _c_exit _errno exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _controlfp_s terminate _exit _beginthreadex _invalid_parameter_noinfo_noreturn

api-ms-win-crt-convert-l1-1-0

atoi _wtof _wtoi _wcstoi64 _strtoui64 _ui64toa

api-ms-win-crt-time-l1-1-0

_mktime64 _time64 _localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_waccess _mkdir

api-ms-win-crt-utility-l1-1-0

abs labs

api-ms-win-crt-multibyte-l1-1-0

_mbscmp _mbsicmp _mbschr

api-ms-win-crt-locale-l1-1-0

setlocale _configthreadlocale

api-ms-win-crt-math-l1-1-0

floor __setusermatherr ceil _except1

Name

.text

Size

393KB

Virtual Size

392KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

444KB

Virtual Size

444KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_51473870c5c61809a69c364522cf7bd2_elex_mespinoza_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

msvcp140

gdiplus

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic