2026-10-14_c0960fd4c75864e1ca0d8ba0fdbeffc3_elex_remcos_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-14_c0960fd4c75864e1ca0d8ba0fdbeffc3_elex_remcos_stealc_stop
Size 378KB
Sample261014-p4e5ysdt4x
SHA256 3577ffcd1d169395ef5756c74f0706cd6c9b3a5b46138955c026c9ece82d7bc8
MD5 c0960fd4c75864e1ca0d8ba0fdbeffc3
SHA1 2f36e0e355173e685be3da0143b0979ae59569cb
SHA512 595d626583c8183be3451970702a52ded21ce6e9cf5eb0814bcecb433a7e1095ab748d5be33932e5b86c4867551679305a8f7236ebd51f102465684148aa2881
SSDEEP 6144:Q7c5tGxX9oJ0EdO4DW6pj8V5LN4Ri7MVqQaaSU/xZj3EEMiBhFMeHzAOwvHh35me:V5te9K0EdO4DW6pj8V5Zinb7qDiBhFNm
TLSH
T12B849E0AEBC1C5B2D85A193C982B9733FD3D46A0177126C7F7E82DA87E403E0A6B5745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-14_c0960fd4c75864e1ca0d8ba0fdbeffc3_elex_remcos_stealc_stop

File Explorer

2026-10-14_c0960fd4c75864e1ca0d8ba0fdbeffc3_elex_remcos_stealc_stop

.exe 378KB

2026-10-14_c0960fd4c75864e1ca0d8ba0fdbeffc3_elex_remcos_stealc_stop

IMPHASH 9abe69421ddd38ac195738f63cacd2ad
SHA256 3577ffcd1d169395ef5756c74f0706cd6c9b3a5b46138955c026c9ece82d7bc8
MD5 c0960fd4c75864e1ca0d8ba0fdbeffc3
SHA1 2f36e0e355173e685be3da0143b0979ae59569cb
SHA512 595d626583c8183be3451970702a52ded21ce6e9cf5eb0814bcecb433a7e1095ab748d5be33932e5b86c4867551679305a8f7236ebd51f102465684148aa2881
SSDEEP 6144:Q7c5tGxX9oJ0EdO4DW6pj8V5LN4Ri7MVqQaaSU/xZj3EEMiBhFMeHzAOwvHh35me:V5te9K0EdO4DW6pj8V5Zinb7qDiBhFNm
TLSH
T12B849E0AEBC1C5B2D85A193C982B9733FD3D46A0177126C7F7E82DA87E403E0A6B5745
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

232053

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

dinput8

DirectInput8Create

dsound

ord11

ddraw

DirectDrawCreateEx

winmm

timeBeginPeriod timeGetTime

kernel32

GetModuleHandleA CreateFileA ClearCommError GetCommState WriteFile SetCommState SetCommTimeouts CreateEventA ReadFile GetOverlappedResult GetLastError SetCommMask WaitCommEvent PurgeComm CloseHandle CreateThread SetFilePointer WideCharToMultiByte MultiByteToWideChar SetLocalTime GetTickCount InitializeCriticalSection LeaveCriticalSection CreateDirectoryA EnterCriticalSection GetLocalTime WaitForSingleObject SetEvent ResetEvent GetCommMask GetCommTimeouts GetFileSize OpenFile SystemTimeToTzSpecificLocalTime _lclose FileTimeToSystemTime GetFileTime GetCurrentProcess Sleep GetPrivateProfileStringA DeleteFileA GetDriveTypeA SetLastError CompareStringA GetStringTypeW GetStringTypeA GetProcessHeap SetEndOfFile GetLocaleInfoA LCMapStringW LCMapStringA GetTimeZoneInformation IsValidCodePage GetOEMCP GetACP GetCPInfo HeapSize FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle LoadLibraryA InterlockedIncrement TlsFree TlsSetValue InitializeCriticalSectionAndSpinCount GetCurrentProcessId QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings TlsAlloc FreeEnvironmentStringsA CompareStringW InterlockedDecrement HeapFree HeapAlloc FindFirstFileA FindClose FileTimeToLocalFileTime SetEnvironmentVariableA GetCurrentDirectoryA ExitThread ResumeThread GetSystemTimeAsFileTime GetCommandLineA GetStartupInfoA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree DeleteCriticalSection VirtualAlloc HeapReAlloc GetModuleHandleW GetProcAddress ExitProcess GetStdHandle GetModuleFileNameA RtlUnwind GetConsoleCP GetConsoleMode RaiseException GetFullPathNameA TlsGetValue GetCurrentThreadId

user32

TranslateMessage ChangeDisplaySettingsA MessageBoxA PostQuitMessage PostMessageA SetRect LoadCursorA UpdateWindow SystemParametersInfoA DispatchMessageA GetAsyncKeyState GetMessageA RegisterClassExA LoadStringA LoadIconA ExitWindowsEx ShowWindow ShowCursor CreateWindowExA PeekMessageA DefWindowProcA

gdi32

CreateFontA DeleteObject

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken

iphlpapi

GetAdaptersInfo

ws2_32

htons

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-14_c0960fd4c75864e1ca0d8ba0fdbeffc3_elex_remcos_stealc_stop

dinput8

dsound

ddraw

winmm

kernel32

user32

gdi32

advapi32

iphlpapi

ws2_32

generic