2026-10-19_d27255e3adc58f080c53f281627d7893_elex_floxif_remcos_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_d27255e3adc58f080c53f281627d7893_elex_floxif_remcos_stop
Size 535KB
Sample261019-v6db2aet61
SHA256 6a52c4857087bff077a1b23e3241ffd6e9f2f4bbb265e28d71e5b5725026a988
MD5 d27255e3adc58f080c53f281627d7893
SHA1 e9100994c27cf6376aae1ff729d5d9c65139820b
SHA512 83f4ee25ea12dd550f6d1a9dc97c3c05fe29605e283f1e8927ceed79d03f962d461aeb25294caae6da4361e84e449ed4f5df03d139688d4c7c42b268677adf60
SSDEEP 12288:zt0TZNJ8wjd413Z1+RUtCLcEcfOqBzrEzBjvrEH7x:zRsdq/+FczGmzrGrEH7x
TLSH
T124C48C10B2A0C279F5F612F16A7ED27526B17AB41B3681CB73C02E6D1E78AD15D32723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-19_d27255e3adc58f080c53f281627d7893_elex_floxif_remcos_stop

File Explorer

2026-10-19_d27255e3adc58f080c53f281627d7893_elex_floxif_remcos_stop

.exe 535KB

2026-10-19_d27255e3adc58f080c53f281627d7893_elex_floxif_remcos_stop

IMPHASH 952269c05bc69baf9f42d1e45b75825b
SHA256 6a52c4857087bff077a1b23e3241ffd6e9f2f4bbb265e28d71e5b5725026a988
MD5 d27255e3adc58f080c53f281627d7893
SHA1 e9100994c27cf6376aae1ff729d5d9c65139820b
SHA512 83f4ee25ea12dd550f6d1a9dc97c3c05fe29605e283f1e8927ceed79d03f962d461aeb25294caae6da4361e84e449ed4f5df03d139688d4c7c42b268677adf60
SSDEEP 12288:zt0TZNJ8wjd413Z1+RUtCLcEcfOqBzrEzBjvrEH7x:zRsdq/+FczGmzrGrEH7x
TLSH
T124C48C10B2A0C279F5F612F16A7ED27526B17AB41B3681CB73C02E6D1E78AD15D32723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

d2:85:10:8b:24:fa:c8:d1:d0:7e:db:bd:f5:6f:06:ab:9e:00:ea:dd:a4:23:c7:98:f6:d2:d4:fa:a6:84:4e:00

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=198303359D,CN=Creative Technology Ltd,O=Creative Technology Ltd,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Mar 31, 2023

SERIALNUMBER=198303359D,CN=Creative Technology Ltd,O=Creative Technology Ltd,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

SERIALNUMBER=198303359D,CN=Creative Technology Ltd,O=Creative Technology Ltd,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2021 - Dec 29, 2040

Subject

SERIALNUMBER=198303359D,CN=Creative Technology Ltd,O=Creative Technology Ltd,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Serial Number

16:1f:e6:35:0a:b4:43:d3:76:3c:a7:c4:4d:71:46:c3

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 18, 2021 - Oct 23, 2024

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 4, 2022 - Jan 1, 2029

Minor OS version

Major OS version

Entry point

95307

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\MyProject\CTAudPf (20200312 v3.97.09)\Src\Release\CTAudSvc.pdb

kernel32

VirtualFree VirtualAlloc GetStdHandle GetModuleFileNameA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapCreate GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA OutputDebugStringW OutputDebugStringA GetProcessHeap lstrcpynW lstrcatA lstrcpyA OpenFile lstrcpynA IsValidCodePage LoadLibraryExW GetOEMCP GetACP GetCPInfo HeapSize CreateThread lstrlenW HeapReAlloc RaiseException RtlUnwind GetCommandLineA ExitProcess HeapAlloc HeapFree IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileIntW GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW InterlockedExchange GetModuleHandleA CreateFileW FlushFileBuffers SetFilePointer GlobalFlags GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom LoadLibraryW LoadLibraryA lstrcmpW GetVersionExA lstrlenA lstrcmpA InterlockedIncrement WaitForSingleObject GetCurrentThreadId MultiByteToWideChar WideCharToMultiByte GetCurrentProcessId FreeLibrary FindResourceW LoadResource LockResource SizeofResource InterlockedDecrement GetModuleHandleW GetProcAddress TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalAlloc GlobalHandle GlobalUnlock GlobalReAlloc GlobalLock EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc SetLastError LocalFree SetConsoleCtrlHandler GlobalFree GetModuleFileNameW FormatMessageW Sleep GetCommandLineW CloseHandle WaitForMultipleObjects CreateEventW ResetEvent GetLastError DisconnectNamedPipe ReadFile WriteFile CreateNamedPipeW ConnectNamedPipe SetEvent GetCurrentProcess SetPriorityClass lstrcpyW lstrcatW lstrcmpiW

user32

CharLowerBuffA wsprintfA wsprintfW SetCursor PostQuitMessage GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetDesktopWindow ClientToScreen ShowWindow SetWindowTextW PostMessageW RegisterWindowMessageW UnregisterDeviceNotification RegisterDeviceNotificationW LoadIconW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect CreateWindowExW GetClassInfoExW UnhookWindowsHookEx MessageBoxW EnableWindow IsWindowEnabled GetLastActivePopup GetWindowLongW GetParent SendMessageW DestroyMenu GetWindowThreadProcessId GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState ValidateRect GetCursorPos PeekMessageW GetClassInfoW RegisterClassW AdjustWindowRectEx GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect PtInRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextW LoadCursorW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState

gdi32

DeleteDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx SetViewportOrgEx SelectObject Escape TextOutW RectVisible PtVisible GetDeviceCaps CreateBitmap GetClipBox SetTextColor SetBkColor DeleteObject OffsetViewportOrgEx ExtTextOutW SaveDC RestoreDC SetMapMode GetStockObject

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

StartServiceCtrlDispatcherW CreateServiceW RegSetValueExW RegEnumKeyA RegOpenKeyA RegOpenKeyExA RegQueryValueExA RegEnumKeyW RegQueryValueW RegOpenKeyW ControlService ReportEventW SetServiceStatus QueryServiceStatus DeregisterEventSource RegisterServiceCtrlHandlerExW OpenServiceW RegisterEventSourceW OpenSCManagerW DeleteService CloseServiceHandle RegEnumValueW RegDeleteValueW RegOpenKeyExW RegEnumKeyExW RegCloseKey InitializeSecurityDescriptor ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyExW RegQueryValueExW RegQueryInfoKeyW RegDeleteKeyW

shell32

CommandLineToArgvW

ole32

StringFromGUID2 PropVariantClear CoInitialize CoUninitialize CoTaskMemAlloc CoTaskMemFree CLSIDFromString StringFromCLSID CoCreateInstance

oleaut32

VariantInit VariantClear VariantChangeType

dsound

ord11

shlwapi

PathFindExtensionW PathRemoveFileSpecW PathCombineW PathFileExistsW PathAppendW StrStrIW PathFindFileNameW PathRemoveExtensionW PathIsFileSpecW

oleacc

LresultFromObject CreateStdAccessibleObject

winmm

mmioAdvance waveOutRestart waveOutClose waveOutReset waveOutWrite waveOutPause waveOutPrepareHeader waveOutOpen waveOutUnprepareHeader mmioGetInfo mmioSeek mmioDescend mmioSetInfo mmioAscend timeGetTime waveOutGetNumDevs waveOutGetDevCapsW mmioRead mmioWrite mmioOpenW mmioCreateChunk mmioClose

crypt32

CertCloseStore CertGetNameStringA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_d27255e3adc58f080c53f281627d7893_elex_floxif_remcos_stop

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

dsound

shlwapi

oleacc

winmm

crypt32

generic