2026-10-19_478fe090a3c3f5bb339273e07abe1470_elex_mafia_nionspy_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_478fe090a3c3f5bb339273e07abe1470_elex_mafia_nionspy_remcos
Size 327KB
Sample261020-1hbfesfv2v
SHA256 2ef88e9d726761de589243ab17242ed5ceb1c56c2464e5cdbd7923523ca19044
MD5 478fe090a3c3f5bb339273e07abe1470
SHA1 b883b7381749eb6a33daf7be258a811be9152209
SHA512 603af4a969766842ef651e06bc03730774b7dbb9a2c1b92d33237201d9db2ee5b24b55800f670ccee573573bcba39b2b4ce27724d025d684fa0a8291187536a0
SSDEEP 6144:U2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:U2TFafJiHCWBWPMjVWrXf1v
TLSH
T1CA647D1276C1C032C52A1574D4BBABB349397E355B21A5C3B3D07E69BDB12D2AE3834E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_478fe090a3c3f5bb339273e07abe1470_elex_mafia_nionspy_remcos

File Explorer

2026-10-19_478fe090a3c3f5bb339273e07abe1470_elex_mafia_nionspy_remcos

.exe 327KB

2026-10-19_478fe090a3c3f5bb339273e07abe1470_elex_mafia_nionspy_remcos

IMPHASH db7fd855f8d56ae5e931f5ee272b9c85
SHA256 2ef88e9d726761de589243ab17242ed5ceb1c56c2464e5cdbd7923523ca19044
MD5 478fe090a3c3f5bb339273e07abe1470
SHA1 b883b7381749eb6a33daf7be258a811be9152209
SHA512 603af4a969766842ef651e06bc03730774b7dbb9a2c1b92d33237201d9db2ee5b24b55800f670ccee573573bcba39b2b4ce27724d025d684fa0a8291187536a0
SSDEEP 6144:U2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG89gkPzDh1v:U2TFafJiHCWBWPMjVWrXf1v
TLSH
T1CA647D1276C1C032C52A1574D4BBABB349397E355B21A5C3B3D07E69BDB12D2AE3834E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

146750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

Process32Next CreateToolhelp32Snapshot GetVersionExA GetComputerNameA GlobalMemoryStatus Sleep SetFileAttributesA GetLocalTime LoadLibraryA GetSystemTime GetDriveTypeA CreateProcessA SetCurrentDirectoryA GetModuleFileNameA CreateThread CreateFileA WriteFile ReadFile CreateMailslotA GlobalLock GlobalUnlock GetTickCount SetEndOfFile CreateFileW GetTimeZoneInformation WriteConsoleW SetStdHandle SetEnvironmentVariableA CompareStringW GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetCurrentProcessId TerminateProcess GetEnvironmentStringsW FreeEnvironmentStringsW CreatePipe GetFileAttributesA OpenProcess Process32First EndUpdateResourceA LoadLibraryExA BeginUpdateResourceA LockResource UpdateResourceA LoadResource FreeLibrary FreeResource FindResourceA CloseHandle GetFileTime SetFileTime GetLocaleInfoW LoadLibraryW IsValidCodePage GetOEMCP GetACP HeapSize GetModuleFileNameW FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointer HeapCreate IsProcessorFeaturePresent GetFileType GetStdHandle SetHandleCount InitializeCriticalSectionAndSpinCount GetCurrentThreadId SetLastError GetProcessHeap TlsFree TlsSetValue TlsGetValue TlsAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter QueryPerformanceCounter OpenFile InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetLastError HeapFree DeleteFileA HeapAlloc HeapReAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA FindNextFileA FindClose GetProcAddress GetModuleHandleW ExitProcess CreateDirectoryA DuplicateHandle GetCurrentProcess GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo

user32

SetWindowsHookExA TranslateMessage GetMessageA GetDesktopWindow DispatchMessageA GetDC GetWindowRect MessageBoxA UnhookWindowsHookEx GetKeyState GetForegroundWindow CallNextHookEx GetWindowTextA ReleaseDC OpenClipboard GetKeyboardLayout GetClipboardData GetWindowThreadProcessId CloseClipboard

gdi32

GetPixel BitBlt DeleteDC SelectObject CreateCompatibleDC CreateCompatibleBitmap

advapi32

RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoUninitialize CoInitializeEx CoTaskMemFree CoCreateInstance

oleaut32

VariantClear VariantInit

shlwapi

PathFileExistsA

wininet

HttpSendRequestA InternetConnectA InternetReadFile HttpOpenRequestA InternetGetConnectedState InternetCloseHandle InternetOpenA

winmm

mciSendStringA

wsock32

gethostbyname send closesocket socket recv htons WSAStartup connect

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_478fe090a3c3f5bb339273e07abe1470_elex_mafia_nionspy_remcos

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

iphlpapi

generic