2026-10-01_d1a4a19ebf4ea4cdd34515ed914748ef_elex_floxif_hijackloader_remcos_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_d1a4a19ebf4ea4cdd34515ed914748ef_elex_floxif_hijackloader_remcos_rhadamanthys_stop
Size 521KB
Sample261002-ca5sasvdqd
SHA256 8bd22b7dd59d4e166b33808a1fde02b6947b7931fa57134a158bd9a61136c686
MD5 d1a4a19ebf4ea4cdd34515ed914748ef
SHA1 0646a1ca29f481e7a2a0d124d28fbace57c02455
SHA512 f5abdb9b5fe03dcd76866c4642fe839b200d9ee742c801c1e9f4431530181868039a8ccf2374a59bb341825d06727cd8a566fcbd166762a33248a65300e33ea7
SSDEEP 12288:cGhDNC4OXNlc5XKmFPU0/ZGKRKVKzKRisYuaBjvrEH7x:jhDxOGKAPU0QKRKVKzKRnYusrEH7x
TLSH
T11FB4C0217BC4C276D2A110326AA6D775A5FABE340B3541C773D03A6C5F785C2AE3872B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-01_d1a4a19ebf4ea4cdd34515ed914748ef_elex_floxif_hijackloader_remcos_rhadamanthys_stop

File Explorer

2026-10-01_d1a4a19ebf4ea4cdd34515ed914748ef_elex_floxif_hijackloader_remcos_rhadamanthys_stop

.exe 521KB

2026-10-01_d1a4a19ebf4ea4cdd34515ed914748ef_elex_floxif_hijackloader_remcos_rhadamanthys_stop

IMPHASH 1850b59326d6e137c4415d6d49d773be
SHA256 8bd22b7dd59d4e166b33808a1fde02b6947b7931fa57134a158bd9a61136c686
MD5 d1a4a19ebf4ea4cdd34515ed914748ef
SHA1 0646a1ca29f481e7a2a0d124d28fbace57c02455
SHA512 f5abdb9b5fe03dcd76866c4642fe839b200d9ee742c801c1e9f4431530181868039a8ccf2374a59bb341825d06727cd8a566fcbd166762a33248a65300e33ea7
SSDEEP 12288:cGhDNC4OXNlc5XKmFPU0/ZGKRKVKzKRisYuaBjvrEH7x:jhDxOGKAPU0QKRKVKzKRnYusrEH7x
TLSH
T11FB4C0217BC4C276D2A110326AA6D775A5FABE340B3541C773D03A6C5F785C2AE3872B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

66:24:a8:f1:4a:e0:e9:1f:54:b2:b3:4d:5e:4b:03:50:bf:f0:3f:3a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,OU=IT PLANNING & DESIGN DEPARTMENT,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

May 26, 2023

CN=SEIKO EPSON CORPORATION,OU=IT PLANNING & DESIGN DEPARTMENT,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=SEIKO EPSON CORPORATION,OU=IT PLANNING & DESIGN DEPARTMENT,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=SEIKO EPSON CORPORATION,OU=IT PLANNING & DESIGN DEPARTMENT,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Serial Number

07:73:be:a2:11:5f:02:7e:4a:66:c0:39:22:8d:de:a0

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Jun 30, 2023

Timespan

Sep 9, 2022 - Sep 30, 2023

Minor OS version

Major OS version

Entry point

157592

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Project\Vega\SourceV3\VegaMonitor\Release\EPPCCMON.pdb

wtsapi32

WTSFreeMemory WTSEnumerateProcessesW

kernel32

ReadFile WriteFile SetFilePointer FlushFileBuffers SetEndOfFile GetFullPathNameW CreateFileW GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapReAlloc RtlUnwind RaiseException ExitThread CreateThread ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW VirtualAlloc GetTimeZoneInformation InitializeCriticalSectionAndSpinCount LCMapStringA GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetConsoleCP GetConsoleMode SetStdHandle GetCurrentDirectoryA GetDriveTypeA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA WritePrivateProfileStringW GetModuleHandleA GlobalFlags InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalReAlloc TlsGetValue LocalAlloc SetErrorMode GetCurrentProcessId GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW LoadLibraryExW CompareStringA InterlockedExchange lstrlenA lstrcmpA SuspendThread SetEvent SetThreadPriority GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW LoadLibraryA GetVersionExA FreeResource FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW FormatMessageW LocalFree MulDiv SetLastError GetExitCodeThread GetCommandLineW GetPrivateProfileIntW CreateFileMappingW FlushViewOfFile UnmapViewOfFile MapViewOfFile GetUserDefaultLangID InterlockedDecrement WaitForMultipleObjects CreateEventW OutputDebugStringW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ResumeThread CloseHandle ReleaseMutex GetModuleFileNameW GetFileAttributesW GetExitCodeProcess GetModuleHandleW WaitForSingleObject GlobalSize GetCurrentProcess CreateMutexW GetPrivateProfileSectionNamesW GlobalHandle FindClose GlobalFree GetLastError GlobalUnlock lstrlenW lstrcmpW GetVersionExW Sleep GetSystemDirectoryW GlobalAlloc GlobalLock FindFirstFileW HeapSize GetTempPathW WideCharToMultiByte GetTickCount LockResource GetProcAddress MultiByteToWideChar SizeofResource LoadLibraryW GetPrivateProfileStringW GetProcessHeap HeapFree HeapAlloc LoadResource FreeLibrary FindResourceW GetEnvironmentStringsW

user32

GrayStringW DrawTextExW DrawTextW TabbedTextOutW ClientToScreen ReleaseDC GetSysColorBrush GetWindowThreadProcessId SetCursor GetCursorPos ValidateRect ShowWindow SetWindowTextW IsDialogMessageW SetDlgItemTextW RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW RemovePropW SetFocus GetWindowTextW GetForegroundWindow GetLastActivePopup GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos GetKeyState SetMenu SetForegroundWindow IsWindowVisible UpdateWindow PostMessageW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetDlgCtrlID CallWindowProcW PtInRect GetMenu SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetSysColor GetSystemMetrics DestroyMenu CopyRect GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW IsWindow GetDlgItem IsWindowEnabled GetNextDlgTabItem SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW CheckMenuItem GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu EndPaint DestroyWindow TranslateAcceleratorW SetTimer GetMessageW PostQuitMessage KillTimer DialogBoxParamW LoadCursorW BeginPaint LoadAcceleratorsW RegisterClassExW LoadIconW EndDialog LoadStringW CreateWindowExW DefWindowProcW MessageBoxW SendMessageW MsgWaitForMultipleObjects TranslateMessage PeekMessageW DispatchMessageW GetWindowRect GetClientRect GetDC GetWindowLongW SetWindowLongW MapWindowPoints GetPropW GetWindow MoveWindow GetSystemMenu EnableMenuItem EnableWindow

gdi32

GetStockObject Escape TextOutW RectVisible PtVisible ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx DeleteDC CreateDCW SetLayout SetMapMode RestoreDC SaveDC DeleteObject SetBkColor SetTextColor GetClipBox ExtTextOutW GetObjectW CreateBitmap GetDeviceCaps ExtEscape SelectObject

winspool.drv

EnumPortsW EnumPrintersW SetJobW GetPrinterW OpenPrinterW GetPrinterDriverW EnumJobsW ClosePrinter GetJobW DocumentPropertiesW

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegSetValueExW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

ShellExecuteExW SHGetSpecialFolderPathW

shlwapi

PathFindExtensionW PathFindFileNameW

wininet

HttpOpenRequestW HttpQueryInfoW InternetCloseHandle HttpSendRequestW InternetConnectW InternetReadFile InternetCrackUrlW InternetQueryDataAvailable InternetOpenW InternetSetOptionW

rpcrt4

UuidCreate

ole32

CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

VariantChangeType VarBstrCmp VariantInit SysAllocString SysAllocStringByteLen SysStringByteLen SysFreeString SysStringLen VariantClear

oleacc

CreateStdAccessibleObject LresultFromObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_d1a4a19ebf4ea4cdd34515ed914748ef_elex_floxif_hijackloader_remcos_rhadamanthys_stop

PE Signature issue

wtsapi32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

wininet

rpcrt4

ole32

oleaut32

oleacc

generic