2026-09-30_c7901326a879e7b25c7a2c308b93c864_elex_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_c7901326a879e7b25c7a2c308b93c864_elex_remcos_stop
Size 1.1MB
Sample260930-jsas7szeld
SHA256 f97ed3c8202efdd533d9f8b67e7b9b20a3eeda366acb554610b64bbb6056a623
MD5 c7901326a879e7b25c7a2c308b93c864
SHA1 6cb0995e7387463a3389c07cc377f71d32ef8da6
SHA512 7d8686f3d3d904fa7b9782701237bc8c99a1c6c028acfb397a013e615105fb15bd3057450ddc18afcbaf9f6c67fb6c5d3aba9486f9d7fd032241b395dbbc4a64
SSDEEP 24576:5wAiMNsAywO9ZIK4jxdKBxviB+drd7iZ477l/:5liMNMWvxiViUdrd7rR
TLSH
T1853502207F54C236D5930172AA3AEB7F612DEE61171910C7B3C83E9D6E705E26E3670A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_c7901326a879e7b25c7a2c308b93c864_elex_remcos_stop

File Explorer

2026-09-30_c7901326a879e7b25c7a2c308b93c864_elex_remcos_stop

.exe 1.1MB

2026-09-30_c7901326a879e7b25c7a2c308b93c864_elex_remcos_stop

IMPHASH d76edc962fa63b290f5758f1f9497c95
SHA256 f97ed3c8202efdd533d9f8b67e7b9b20a3eeda366acb554610b64bbb6056a623
MD5 c7901326a879e7b25c7a2c308b93c864
SHA1 6cb0995e7387463a3389c07cc377f71d32ef8da6
SHA512 7d8686f3d3d904fa7b9782701237bc8c99a1c6c028acfb397a013e615105fb15bd3057450ddc18afcbaf9f6c67fb6c5d3aba9486f9d7fd032241b395dbbc4a64
SSDEEP 24576:5wAiMNsAywO9ZIK4jxdKBxviB+drd7iZ477l/:5liMNMWvxiViUdrd7rR
TLSH
T1853502207F54C236D5930172AA3AEB7F612DEE61171910C7B3C83E9D6E705E26E3670A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

195632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\KINGSOFT_DUBA\Build\Build_Src\dump\dump\src\product\win32\kdumprep.pdb

kernel32

LoadLibraryW GetPrivateProfileStringW GetPrivateProfileStringA GetTickCount TerminateThread Sleep GetExitCodeThread WritePrivateProfileStringW OutputDebugStringA GetCurrentProcess FlushInstructionCache GetCurrentThreadId RaiseException lstrcmpiW GetSystemDirectoryW CreateDirectoryW GetTempFileNameW CopyFileW GetCommandLineW GetTempPathW CreateProcessW GetPrivateProfileIntW DeleteFileW InitializeCriticalSection InterlockedIncrement InterlockedDecrement FreeLibrary LoadLibraryExW DeleteCriticalSection FindFirstFileW FindClose FindNextFileW SetFilePointer SystemTimeToFileTime WriteFile FileTimeToSystemTime ReadFile GetLocalTime GetFileInformationByHandle GetVersionExW GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalMemoryStatusEx InterlockedCompareExchange GetStringTypeExW CreateFileA FlushFileBuffers LocalAlloc LocalFree GetThreadLocale IsProcessorFeaturePresent GetCurrentProcessId WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InterlockedExchange LoadLibraryA RtlUnwind GetLocaleInfoA GetStringTypeW GetStringTypeA GetConsoleMode GetConsoleCP QueryPerformanceCounter GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount LCMapStringW LCMapStringA ExitProcess GetModuleFileNameA GetStdHandle HeapSize VirtualAlloc VirtualFree HeapCreate HeapDestroy IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleA GetStartupInfoW LeaveCriticalSection EnterCriticalSection OpenProcess GetModuleHandleW GetProcAddress GetFileAttributesW GetModuleFileNameW lstrlenA CreateFileW SetLastError MultiByteToWideChar WideCharToMultiByte lstrcpyW FindResourceExW LoadResource LockResource SizeofResource FindResourceW CreateThread WaitForSingleObject lstrlenW UnmapViewOfFile GetFileSize MapViewOfFile GetProcessHeap GetVersionExA GetSystemTimeAsFileTime HeapAlloc HeapReAlloc HeapFree IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess CloseHandle CreateFileMappingW GetLastError

user32

MoveWindow GetWindowRect SetForegroundWindow PostMessageW wsprintfW GetDlgCtrlID GetCursorPos RedrawWindow SetCursor LoadCursorW LoadStringW wvsprintfW SetWindowLongW SetDlgItemTextW GetMessageW GetActiveWindow GetWindowDC ReleaseDC InvalidateRect UpdateWindow GetWindowTextLengthW BeginPaint GetWindowTextW EndPaint LoadBitmapW DrawIcon EndDialog GetDlgItem DispatchMessageW EnableWindow ScreenToClient TranslateMessage UnregisterClassA PeekMessageW SetWindowTextW CharLowerBuffW GetDesktopWindow CharNextW wvsprintfA MessageBoxW PostQuitMessage IsWindowVisible wsprintfA CallWindowProcW GetWindowLongW DestroyWindow CreateDialogParamW DialogBoxParamW DefWindowProcW EnableMenuItem GetMenuItemID GetMenuItemCount GetSystemMenu SendMessageW ShowWindow

gdi32

CreateBitmap SetBkColor TextOutW SetTextColor CreateFontW CreateSolidBrush SelectObject DeleteObject BitBlt CreateCompatibleDC DeleteDC SetBkMode

advapi32

RegCreateKeyExW RegQueryValueExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW

shell32

SHGetFileInfoW SHGetFolderPathW CommandLineToArgvW ShellExecuteA ShellExecuteW

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance

oleaut32

VarUI4FromStr

shlwapi

PathFindExtensionW PathStripPathW PathAppendW PathFileExistsW PathRemoveFileSpecW PathIsDirectoryW StrToIntW PathAddBackslashW PathFindFileNameW

comctl32

ImageList_DrawEx ImageList_Destroy ImageList_LoadImageW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

ws2_32

htons inet_addr gethostbyname connect WSAAsyncSelect send socket WSACleanup closesocket WSAStartup WSAGetLastError setsockopt

psapi

EnumProcesses GetModuleFileNameExW GetProcessMemoryInfo

wininet

InternetCloseHandle InternetReadFile HttpSendRequestW HttpOpenRequestW InternetConnectW InternetSetOptionW InternetOpenW

dbghelp

StackWalk64 MiniDumpReadDumpStream

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_c7901326a879e7b25c7a2c308b93c864_elex_remcos_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

ws2_32

psapi

wininet

dbghelp

generic