2026-10-01_4c9e0d59fee7d1cb8acf8307604a2a52_elex_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_4c9e0d59fee7d1cb8acf8307604a2a52_elex_stop
Size 11.9MB
Sample261002-sh9dfsty6k
SHA256 71b6192e3378b4ef531277b93dfdc58015c769b8d9d2a3bab79be4411cdd05a0
MD5 4c9e0d59fee7d1cb8acf8307604a2a52
SHA1 2be063b713c7653c82f9b64de02ad579b589a4e8
SHA512 d0aa0b2d2fc35d75312aeabfc5ad54e68ccbf948dcf2368bd9077b0748004498da4d9bdacf32cacde3d7588ce7b9d3bceaa9e5d776bdaee0792c3c4dd46eff9f
SSDEEP 196608:lLi8U6HBQZR0y0WFIxhtADw7K+jKDD3Jr9laj+YmCN8FRMPg4s2qZcQ9kwX87dzU:6dZR0y0cIXtAt4qoeuZq6MRcC
TLSH
T139C6334527E5C1BBEBC310F54896922E18779DD13BDA8EC7FBC43D1A4EB02CA2A35251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-01_4c9e0d59fee7d1cb8acf8307604a2a52_elex_stop

.exe 11.9MB

2026-10-01_4c9e0d59fee7d1cb8acf8307604a2a52_elex_stop

IMPHASH 7ea4d3b4981577bc540bdfb878a962cf
SHA256 71b6192e3378b4ef531277b93dfdc58015c769b8d9d2a3bab79be4411cdd05a0
MD5 4c9e0d59fee7d1cb8acf8307604a2a52
SHA1 2be063b713c7653c82f9b64de02ad579b589a4e8
SHA512 d0aa0b2d2fc35d75312aeabfc5ad54e68ccbf948dcf2368bd9077b0748004498da4d9bdacf32cacde3d7588ce7b9d3bceaa9e5d776bdaee0792c3c4dd46eff9f
SSDEEP 196608:lLi8U6HBQZR0y0WFIxhtADw7K+jKDD3Jr9laj+YmCN8FRMPg4s2qZcQ9kwX87dzU:6dZR0y0cIXtAt4qoeuZq6MRcC
TLSH
T139C6334527E5C1BBEBC310F54896922E18779DD13BDA8EC7FBC43D1A4EB02CA2A35251
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

14:d5:7e:80:3f:bf:86:9b:19:39:d8:5f:94:de:9b:dd:6e:3f:78:47:43:d9:7f:a7:94:4b:7b:7a:2e:80:f9:e8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=9144030071526726XG,CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13124775616e67646f6e672050726f76696e6365,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Aug 20, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:be:06:97:d0:95:e5:5f:91:8f:5e:17:83:38:3d:c8

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2025 - Nov 4, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

81080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\TXPCGJ\QQPCMgr_proj\13.0.46265.301_for_gf2.0_dev\Source\Setup\PackageTools\product\win32\dbginfo\kpacket.pdb

kernel32

SizeofResource LockResource LoadResource GetTempPathW CreateFileW FindResourceExW GetCurrentProcess GetFileSize GetModuleHandleW ExpandEnvironmentStringsW TerminateProcess GetWindowsDirectoryW FindFirstFileW lstrcmpW GetCurrentDirectoryW SetFileAttributesW DeleteFileW MoveFileExW GetFileAttributesW GetTickCount CreateDirectoryW GetLastError FindNextFileW SetFilePointer FindClose ReadFile RemoveDirectoryW WriteFile CreateProcessW GetModuleFileNameW WaitForSingleObject GetSystemDirectoryW MultiByteToWideChar GetCommandLineW WideCharToMultiByte UnmapViewOfFile SetEndOfFile CreateFileMappingW MapViewOfFile EnterCriticalSection GetCurrentProcessId WaitForMultipleObjects VirtualFree VirtualAlloc DeleteCriticalSection SetEvent InitializeCriticalSection ReleaseSemaphore ResetEvent CreateSemaphoreW CreateEventW GetStdHandle GetFileInformationByHandle CopyFileW SetFileTime MoveFileW GetTempFileNameW GetSystemInfo SystemTimeToFileTime LocalFileTimeToFileTime FileTimeToSystemTime GetLocalTime WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW CreateFileA CloseHandle FindResourceW GetProcAddress LoadLibraryW LeaveCriticalSection FlushFileBuffers SetStdHandle LoadLibraryA GetConsoleMode GetConsoleCP GetSystemTimeAsFileTime QueryPerformanceCounter GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetModuleFileNameA HeapCreate GetStringTypeW RaiseException GetVersionExA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale InterlockedIncrement InterlockedDecrement Sleep UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread GetCurrentThreadId CreateThread GetStartupInfoW RtlUnwind LCMapStringA LCMapStringW GetCPInfo GetOEMCP IsValidCodePage GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError ExitProcess GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA

user32

UnregisterClassA CharLowerW CharUpperW GetDesktopWindow

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

ole32

CoUninitialize CoInitialize

oleaut32

SysFreeString SysAllocString VariantClear VariantCopy

shlwapi

PathAddBackslashW PathRemoveFileSpecW PathIsDirectoryW PathAppendW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_4c9e0d59fee7d1cb8acf8307604a2a52_elex_stop

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

generic