2026-08-31_bbd5d928c7503d37980c0f8d6a975af9_elex_mafia_nionspy_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-31_bbd5d928c7503d37980c0f8d6a975af9_elex_mafia_nionspy_remcos
Size 288KB
Sample260831-spahpsvbqa
SHA256 f81d13d2902ad749dd28a6f757eb8bb86a722135b6e77d68884450af283e5a30
MD5 bbd5d928c7503d37980c0f8d6a975af9
SHA1 95bdf24ff8acdcd9e90c25e00d4d7a88cfd5c7db
SHA512 8daee09401a4d90a2f17b8ab7b100336f831eb0d50503f53f4ff310e1fced4b7b0fdcb6eb8acefa546e1a91edfb4e0a28db944128db064411bac41e4f3af629d
SSDEEP 6144:TQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:TQMyfmNFHfnWfhLZVHmOog
TLSH
T16F549C107691C432C457267045AFABB24D793A752F36A6C3B7E01E69DE203E2EE7434E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-31_bbd5d928c7503d37980c0f8d6a975af9_elex_mafia_nionspy_remcos

File Explorer

2026-08-31_bbd5d928c7503d37980c0f8d6a975af9_elex_mafia_nionspy_remcos

.exe 288KB

2026-08-31_bbd5d928c7503d37980c0f8d6a975af9_elex_mafia_nionspy_remcos

IMPHASH 5c0e4007f69c1e2127fbd8b35d9e1818
SHA256 f81d13d2902ad749dd28a6f757eb8bb86a722135b6e77d68884450af283e5a30
MD5 bbd5d928c7503d37980c0f8d6a975af9
SHA1 95bdf24ff8acdcd9e90c25e00d4d7a88cfd5c7db
SHA512 8daee09401a4d90a2f17b8ab7b100336f831eb0d50503f53f4ff310e1fced4b7b0fdcb6eb8acefa546e1a91edfb4e0a28db944128db064411bac41e4f3af629d
SSDEEP 6144:TQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:TQMyfmNFHfnWfhLZVHmOog
TLSH
T16F549C107691C432C457267045AFABB24D793A752F36A6C3B7E01E69DE203E2EE7434E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

144134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenProcess TerminateProcess Process32Next CreateToolhelp32Snapshot GetVersionExA GetComputerNameA GlobalMemoryStatus Sleep SetFileAttributesA GetLocalTime LoadLibraryA GetSystemTime CreateProcessA SetCurrentDirectoryA GetModuleFileNameA CreateThread CreateFileA WriteFile ReadFile CreateMailslotA GetDriveTypeA GlobalLock Process32First GetTickCount SetEndOfFile CreateFileW GetTimeZoneInformation WriteConsoleW SetStdHandle SetEnvironmentVariableA CompareStringW GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetLocaleInfoW LoadLibraryW IsValidCodePage EndUpdateResourceA LoadLibraryExA BeginUpdateResourceA LockResource UpdateResourceA FreeLibrary LoadResource FreeResource FindResourceA CloseHandle GetFileTime SetFileTime GlobalUnlock OpenFile GetOEMCP GetACP GetModuleFileNameW FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointer HeapCreate GetFileType GetStdHandle SetHandleCount InitializeCriticalSectionAndSpinCount GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsGetValue GetProcessHeap TlsAlloc HeapSize IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess GetCPInfo MultiByteToWideChar LCMapStringW WideCharToMultiByte InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetLastError HeapFree DeleteFileA HeapAlloc HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA FindNextFileA FindClose GetProcAddress GetModuleHandleW ExitProcess CreateDirectoryA GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind

user32

SetWindowsHookExA TranslateMessage GetMessageA GetDesktopWindow DispatchMessageA GetDC GetWindowRect MessageBoxA UnhookWindowsHookEx GetKeyState GetWindowThreadProcessId GetForegroundWindow CallNextHookEx GetWindowTextA ReleaseDC GetKeyboardLayout OpenClipboard GetClipboardData CloseClipboard

gdi32

DeleteDC SelectObject CreateCompatibleDC CreateCompatibleBitmap GetPixel BitBlt

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoUninitialize CoInitializeEx CoTaskMemFree CoCreateInstance

oleaut32

VariantClear VariantInit

shlwapi

PathFileExistsA

wininet

InternetGetConnectedState InternetConnectA InternetReadFile HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle

winmm

mciSendCommandA mciSendStringA

wsock32

send gethostbyname closesocket socket htons WSAStartup connect

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-31_bbd5d928c7503d37980c0f8d6a975af9_elex_mafia_nionspy_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

generic