2026-08-23_41fd9661642baff199e024e1fd346c14_elex_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-23_41fd9661642baff199e024e1fd346c14_elex_remcos_stop
Size 1.3MB
Sample260824-qdpgdatxcw
SHA256 bc6f3de8a1b46c4d97ead5619995922f6fd839a9c14f26a08c2f2f548e5a68a1
MD5 41fd9661642baff199e024e1fd346c14
SHA1 fc738e4c7c93b064c908fd24b4ec5f8ebaa8b231
SHA512 0fc1d968dcc00e500bfad7abdf07ea0e814e658294e51e48f72b74b6d7891d70d48b296d9625d004447d8507e228cdc61625138e1b31fc2c5c8dbeb48525f158
SSDEEP 24576:etRyQugFquACk6T0EPd8siS8jyOPUSeVY+rL:oyFgFquACkgUaSeXrL
TLSH
T1F9557D6273E0C4A5F4F31B709E7962A08AB97D769830C59F1B903E5E7C32A41D925F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-23_41fd9661642baff199e024e1fd346c14_elex_remcos_stop

.exe 1.3MB

2026-08-23_41fd9661642baff199e024e1fd346c14_elex_remcos_stop

IMPHASH d8c2ecec62f3e9bbdf8880b81076289c
SHA256 bc6f3de8a1b46c4d97ead5619995922f6fd839a9c14f26a08c2f2f548e5a68a1
MD5 41fd9661642baff199e024e1fd346c14
SHA1 fc738e4c7c93b064c908fd24b4ec5f8ebaa8b231
SHA512 0fc1d968dcc00e500bfad7abdf07ea0e814e658294e51e48f72b74b6d7891d70d48b296d9625d004447d8507e228cdc61625138e1b31fc2c5c8dbeb48525f158
SSDEEP 24576:etRyQugFquACk6T0EPd8siS8jyOPUSeVY+rL:oyFgFquACkgUaSeXrL
TLSH
T1F9557D6273E0C4A5F4F31B709E7962A08AB97D769830C59F1B903E5E7C32A41D925F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

24:c4:6d:0b:0a:77:05:1b:e1:09:c1:b3:55:e5:87:71:a7:cf:8c:23:fc:09:b6:7f:55:eb:35:b0:08:98:ad:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4489370,CN=NCH Software\, Inc.,O=NCH Software\, Inc.,L=Greenwood Village,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Feb 21, 2022

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

c5:d5:b3:ee:42:dc:a9:41:ad:14:cc:66:e5:a0:ab:3c:48:fd:4f:60

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

Chains

Feb 21, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

Serial Number

0a:01:c3:ff:88:55:f0:08:c8:e4:fa:63:97:32:52:e6

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2019 - Mar 30, 2022

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

Serial Number

07:b9:14:f4:75:ba:6f:ac:ea:57:5d:b5:25:12:5c:7a

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2019 - Mar 30, 2022

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2020 - Dec 29, 2030

Minor OS version

Major OS version

Entry point

604671

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\sourcecode\disketch\release\Disketch.pdb

kernel32

OpenFileMappingW TerminateProcess GetFileTime FileTimeToLocalFileTime GetCurrentThreadId ProcessIdToSessionId LocalFree ReleaseMutex CreateToolhelp32Snapshot RemoveDirectoryW SetFilePointer GetModuleFileNameA ExitProcess CreateThread HeapFree GetStdHandle GetCurrentProcess FindClose SetCurrentDirectoryW FindResourceW GetLocaleInfoW GetTimeZoneInformation GetEnvironmentVariableW InterlockedDecrement GetThreadPriority GlobalLock GetProcessHeap QueryPerformanceCounter GlobalFree GetStartupInfoW SetEnvironmentVariableW PeekNamedPipe SetLastError GetModuleFileNameW ConnectNamedPipe SetThreadPriority SetUnhandledExceptionFilter GetCurrentThread SetEndOfFile DeviceIoControl SetEvent ReadFile SizeofResource CreateNamedPipeW SetFileAttributesW LockResource Process32FirstW lstrcpyW GlobalSize GetCurrentProcessId FindNextFileW VerifyVersionInfoW GetTickCount ResumeThread QueryPerformanceFrequency GlobalHandle HeapAlloc CreatePipe WaitForMultipleObjects CreateDirectoryW GetComputerNameW LocalAlloc GetModuleHandleW VirtualQuery CreateMutexW LoadLibraryW lstrlenA SetEnvironmentVariableA CompareStringW GetLogicalDriveStringsW GetCommandLineW GetPrivateProfileIntW GetPrivateProfileStringW GetPrivateProfileSectionNamesW FormatMessageW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetDriveTypeW lstrcmpW GlobalAlloc UnmapViewOfFile MoveFileExW LoadResource VerSetConditionMask GetACP FindFirstFileW Process32NextW GlobalUnlock MapViewOfFile CopyFileW DuplicateHandle GetSystemTime GetVersionExA ResetEvent GetOverlappedResult GetSystemInfo Sleep FreeResource WaitForSingleObject WaitNamedPipeW SetFilePointerEx MultiByteToWideChar GetProcAddress DisconnectNamedPipe CreateFileW InitializeCriticalSection DeleteCriticalSection GetFileSizeEx GetVersionExW CreateEventW CreateProcessW CloseHandle WriteFile EnterCriticalSection OpenProcess GetLastError MulDiv FreeLibrary GlobalMemoryStatusEx LoadLibraryA GetTempPathW DeleteFileW FlushFileBuffers LeaveCriticalSection WideCharToMultiByte GetFileAttributesW CancelIo CompareStringA CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InterlockedExchange RaiseException RtlUnwind GetConsoleMode GetConsoleCP GetLocaleInfoA GetSystemTimeAsFileTime GetCommandLineA GetStartupInfoA GetCPInfo InterlockedIncrement GetOEMCP IsValidCodePage GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue GetStringTypeW GetStringTypeA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapReAlloc VirtualAlloc VirtualFree HeapCreate HeapDestroy LCMapStringW LCMapStringA HeapSize IsDebuggerPresent UnhandledExceptionFilter TlsFree

advapi32

RegOpenKeyExW GetSidLengthRequired InitializeAcl RegDeleteKeyW OpenProcessToken RegDeleteValueW InitializeSecurityDescriptor RegEnumKeyExW RegEnumKeyW SetFileSecurityW AddAccessAllowedAce GetAce RegSetValueExW RegOpenKeyW RegSetKeySecurity InitializeSid RegQueryInfoKeyW DuplicateTokenEx SetSecurityDescriptorDacl RegCloseKey RegCreateKeyExW GetUserNameW RegQueryValueExW GetSidSubAuthority RegEnumValueW

comctl32

CreatePropertySheetPageW _TrackMouseEvent CreateToolbarEx ImageList_GetIconSize ord17 PropertySheetW ImageList_DrawEx ImageList_ReplaceIcon ImageList_Destroy ImageList_Duplicate ImageList_Replace ImageList_Create

comdlg32

GetSaveFileNameW CommDlgExtendedError PrintDlgW GetOpenFileNameW ChooseColorW

gdi32

GetFontData EndPage GetStockObject CreateFontIndirectW SetBkMode EndDoc CreateFontW GetObjectW GetCurrentObject StartDocW CreateCompatibleDC DeleteDC SelectObject GetTextMetricsW StartPage DeleteObject CreateSolidBrush CreateDCW CreateDIBSection Polygon CreateCompatibleBitmap SetBrushOrgEx GetBitmapBits SetStretchBltMode GetBkMode SetWindowExtEx SetBitmapBits SetTextColor BitBlt GetGlyphIndicesW GetOutlineTextMetricsW TextOutW SetDIBits SetPixel GetGlyphOutlineW CreatePen GetObjectA GetTextFaceW CreateRectRgnIndirect MoveToEx SetBkColor CreatePatternBrush SetDIBitsToDevice CreateDIBitmap Polyline StretchBlt LineTo CombineRgn PolyPolyline SetViewportExtEx GetDIBits GetTextExtentPoint32W GetViewportExtEx GetWindowExtEx GetDeviceCaps

ole32

CoInitialize CoSetProxyBlanket CoTaskMemAlloc CoUninitialize CoTaskMemFree CoInitializeSecurity CreateStreamOnHGlobal CoCreateInstance

oleaut32

SysStringByteLen OleLoadPicturePath SysAllocStringLen OleLoadPicture SysFreeString SysAllocStringByteLen SysAllocString VariantInit VariantClear

shell32

SHGetPathFromIDListW DragAcceptFiles SHGetFolderPathW ord155 DragFinish ShellExecuteExW ShellExecuteW SHChangeNotify SHCreateShellItem ord680 CommandLineToArgvW SHBrowseForFolderW SHGetMalloc SHParseDisplayName DragQueryFileW

shlwapi

SHDeleteKeyW StrCmpLogicalW SHDeleteEmptyKeyW PathCompactPathExW

user32

DefWindowProcW FrameRect WaitForInputIdle SendMessageW BeginPaint MoveWindow GetSysColor GetDlgItem SetActiveWindow DrawEdge PostQuitMessage DrawStateW GetKeyboardState GetPriorityClipboardFormat CallWindowProcW AllowSetForegroundWindow GetDlgItemTextW UnhookWindowsHookEx GetAsyncKeyState GetMonitorInfoW CopyImage GetKeyNameTextW SetClipboardData AdjustWindowRectEx GetClipboardData wsprintfW UpdateWindow RemovePropW SetMenu MonitorFromPoint OpenClipboard WindowFromDC MapWindowPoints GetActiveWindow WindowFromPoint ClientToScreen EndMenu LoadImageW MonitorFromWindow TranslateMessage MsgWaitForMultipleObjects GetMessageW CreateDialogParamW PeekMessageW GetClassNameA CharUpperW RegisterClassW RegisterClipboardFormatW SetWindowsHookExW IsDialogMessageW GetDlgCtrlID CloseClipboard CountClipboardFormats InsertMenuW SetCapture CallNextHookEx DrawIconEx ScrollWindowEx SystemParametersInfoW LoadIconW GetWindowDC MapDialogRect GetMenuInfo FindWindowW IsWindow SetScrollInfo GetAncestor InsertMenuItemW GetScrollInfo GetWindowTextW GetScrollBarInfo GetSubMenu EnumChildWindows EmptyClipboard SetDlgItemTextW GetPropW GetIconInfo MonitorFromRect GetMenuStringW FlashWindowEx GetForegroundWindow GetWindow IsClipboardFormatAvailable SetPropW SetForegroundWindow MapVirtualKeyW GetMenuItemInfoW GetDesktopWindow CreateDialogIndirectParamW IsCharAlphaW keybd_event DispatchMessageW GetWindowThreadProcessId InflateRect EndDialog DialogBoxIndirectParamW SetMenuItemInfoW SetMenuInfo GetSysColorBrush LoadStringW CheckMenuItem SetWindowPlacement IsDlgButtonChecked ScreenToClient TrackPopupMenu SetWindowPos GetWindowRect SetWindowLongW GetSystemMetrics SetWindowTextW PostMessageW IsWindowVisible DeleteMenu DestroyMenu IsIconic SetCursor DrawTextW KillTimer GetFocus GetDC ShowWindow GetClientRect GetWindowTextLengthW SendDlgItemMessageW GetParent LoadCursorW DrawTextExW SetTimer FillRect GetWindowLongW EnableWindow DialogBoxParamW AppendMenuW SetClassLongW IsZoomed GetCursor GetClassNameW GetWindowPlacement DrawFocusRect GetMenu CheckDlgButton MessageBoxW ReleaseDC InvalidateRect GetCapture CreatePopupMenu DestroyWindow RedrawWindow CreateWindowExW EndPaint FindWindowExW IsWindowEnabled DestroyIcon SetFocus ReleaseCapture GetCursorInfo GetKeyState EnableMenuItem

ws2_32

connect setsockopt select WSAStartup htons socket __WSAFDIsSet inet_addr recv ntohs ioctlsocket gethostbyname WSAGetLastError send closesocket

winspool.drv

OpenPrinterW

netapi32

NetUserGetInfo NetApiBufferFree

msimg32

GradientFill AlphaBlend

iphlpapi

GetAdaptersAddresses

wininet

InternetGetConnectedState InternetQueryOptionA

secur32

InitializeSecurityContextW DecryptMessage DeleteSecurityContext AcquireCredentialsHandleW EncryptMessage FreeCredentialsHandle ApplyControlToken FreeContextBuffer QueryContextAttributesW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_41fd9661642baff199e024e1fd346c14_elex_remcos_stop

PE Signature issue

kernel32

advapi32

comctl32

comdlg32

gdi32

ole32

oleaut32

shell32

shlwapi

user32

ws2_32

winspool.drv

netapi32

msimg32

iphlpapi

wininet

secur32

generic