2026-09-10_4e03b807468ffedaed326b63db0abe00_elex_remcos_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_4e03b807468ffedaed326b63db0abe00_elex_remcos_rhadamanthys_stop
Size 956KB
Sample260910-vma3kasgma
SHA256 e3933a965dac833339e142d8551434131d08ee3d3b2769acda6f21d826d95eda
MD5 4e03b807468ffedaed326b63db0abe00
SHA1 66f3653ad7104ce917ca8078fb02b67f38aeec75
SHA512 f5307ed3bc712f3d054f32636a8a45efa9890057e7a64dad96b7303842273d1c6d583c04bd07a84a48d97bd3432715b420a0f088b4c969819d02e36e02a55744
SSDEEP 24576:RtYz52V2+qQrrMMDMMM64gXe4i7ojhsP5Lgrk1TWb4AN5:Rt02VlqQrrMMDMMM6Pe30jaNf1TWbdz
TLSH
T10325F1203FC4C437C29111729AEAC7B6A5ADAD315F2085C777D03E799E70AD2AA38717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_4e03b807468ffedaed326b63db0abe00_elex_remcos_rhadamanthys_stop

File Explorer

2026-09-10_4e03b807468ffedaed326b63db0abe00_elex_remcos_rhadamanthys_stop

.exe 956KB

2026-09-10_4e03b807468ffedaed326b63db0abe00_elex_remcos_rhadamanthys_stop

IMPHASH 263c96521f3f212d2967b32a1c07bf12
SHA256 e3933a965dac833339e142d8551434131d08ee3d3b2769acda6f21d826d95eda
MD5 4e03b807468ffedaed326b63db0abe00
SHA1 66f3653ad7104ce917ca8078fb02b67f38aeec75
SHA512 f5307ed3bc712f3d054f32636a8a45efa9890057e7a64dad96b7303842273d1c6d583c04bd07a84a48d97bd3432715b420a0f088b4c969819d02e36e02a55744
SSDEEP 24576:RtYz52V2+qQrrMMDMMM64gXe4i7ojhsP5Lgrk1TWb4AN5:Rt02VlqQrrMMDMMM6Pe30jaNf1TWbdz
TLSH
T10325F1203FC4C437C29111729AEAC7B6A5ADAD315F2085C777D03E799E70AD2AA38717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

140851

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Administrator\SoftwareUpdater\Ryoga\EPSDNMON\Release\EPSDNMON.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

SetFilePointer FlushFileBuffers SetEndOfFile GetFullPathNameW CreateFileW GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess GetSystemTimeAsFileTime HeapReAlloc RtlUnwind RaiseException GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW WriteFile SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation LCMapStringW GetTimeFormatA GetDateFormatA VirtualAlloc InitializeCriticalSectionAndSpinCount GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW SetStdHandle GetConsoleCP GetConsoleMode LCMapStringA GetCurrentDirectoryA GetDriveTypeA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA ReadFile GlobalFlags GetModuleHandleA TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc GetCurrentProcessId InterlockedDecrement InterlockedIncrement GlobalAddAtomW GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA lstrlenA GlobalDeleteAtom GetCurrentThreadId lstrcmpA GetLocaleInfoW CompareStringA FindFirstFileW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW FindClose GlobalLock GlobalUnlock FormatMessageW LocalFree lstrlenW Process32NextW Process32FirstW CreateToolhelp32Snapshot ReleaseMutex Sleep CreateMutexW DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW FreeLibrary DeleteFileW WritePrivateProfileStringW CopyFileW GetPrivateProfileIntW GetVersionExW CloseHandle GetLastError GetExitCodeProcess WaitForSingleObject CreateProcessW GetCurrentProcess GetModuleFileNameW GetPrivateProfileStringW SetLastError GetProcAddress GetModuleHandleW GlobalFree GetPrivateProfileSectionNamesW GlobalSize GlobalAlloc lstrcmpW GetTickCount GetTempPathW FindResourceW LoadResource LockResource SizeofResource WideCharToMultiByte MultiByteToWideChar HeapSize HeapFree HeapAlloc GetProcessHeap GetCommandLineW

user32

DestroyMenu ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW ValidateRect GetWindowThreadProcessId GetDC ReleaseDC GetSysColorBrush IsWindowEnabled SetWindowTextW SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem RegisterWindowMessageW WinHelpW GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW SetPropW GetPropW RemovePropW GetFocus IsWindow GetWindowTextW GetForegroundWindow GetLastActivePopup GetDlgItem UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetMenu SetForegroundWindow GetClientRect MessageBoxW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx GetParent GetDlgCtrlID SendMessageW CallWindowProcW CopyRect PtInRect GetMenu GetWindowLongW SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetSystemMetrics GetClassNameW GetWindow GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow DialogBoxParamW SetTimer CreateWindowExW FindWindowW RegisterClassExW LoadCursorW LoadIconW DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW LoadAcceleratorsW LoadStringW EnableWindow PostMessageW GetTopWindow

gdi32

DeleteDC GetStockObject Escape ExtTextOutW TextOutW RectVisible PtVisible ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx GetDeviceCaps DeleteObject SetMapMode RestoreDC SaveDC CreateBitmap SetBkColor SetTextColor GetClipBox SelectObject

winspool.drv

DocumentPropertiesW GetPrinterW GetPrinterDriverW OpenPrinterW EnumPrinterDriversW EnumPrintersW GetPrinterDataW ClosePrinter

shell32

SHGetMalloc SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteExW SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

wtsapi32

WTSEnumerateProcessesW WTSFreeMemory

oleaut32

VariantClear VariantChangeType VariantInit

oleacc

CreateStdAccessibleObject LresultFromObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_4e03b807468ffedaed326b63db0abe00_elex_remcos_rhadamanthys_stop

version

kernel32

user32

gdi32

winspool.drv

shell32

shlwapi

wtsapi32

oleaut32

oleacc

generic