2026-10-19_61fab18520c9783cd6f00337c7644ec1_elex_floxif_remcos_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_61fab18520c9783cd6f00337c7644ec1_elex_floxif_remcos_stealc_stop
Size 394KB
Sample261020-xdmfcadv51
SHA256 fa2e5d3b1b4b9d8e5a860aac97be52a5a0e107353444cdb393766de8a51ce6db
MD5 61fab18520c9783cd6f00337c7644ec1
SHA1 438d391dadfdb5d731da953c255c79cbbbbe0331
SHA512 9d1db8e53f1477b62b560a67d836ae8d7ff15a2d96c8ef910df5d8f691e365256fc7c7e348b73efd9c40f61dbf0701aad0050cd3cd47eb230cd4d64c5a00cae6
SSDEEP 6144:ardWssVvjkwIoawy2vhBJnBOwlFTaGkOiAfNVZSVBV+UdvrEFp7hKR:a0sUApoayvhBnOCGGiAfnWBjvrEH76
TLSH
T10A846C117601D37AE56300B1ABBE86BD96B86939075520C3E3C84DB95FBD6E27A3130F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-19_61fab18520c9783cd6f00337c7644ec1_elex_floxif_remcos_stealc_stop

File Explorer

2026-10-19_61fab18520c9783cd6f00337c7644ec1_elex_floxif_remcos_stealc_stop

.exe 394KB

2026-10-19_61fab18520c9783cd6f00337c7644ec1_elex_floxif_remcos_stealc_stop

IMPHASH d0c51893a1980a1f897e3d11ac6bea46
SHA256 fa2e5d3b1b4b9d8e5a860aac97be52a5a0e107353444cdb393766de8a51ce6db
MD5 61fab18520c9783cd6f00337c7644ec1
SHA1 438d391dadfdb5d731da953c255c79cbbbbe0331
SHA512 9d1db8e53f1477b62b560a67d836ae8d7ff15a2d96c8ef910df5d8f691e365256fc7c7e348b73efd9c40f61dbf0701aad0050cd3cd47eb230cd4d64c5a00cae6
SSDEEP 6144:ardWssVvjkwIoawy2vhBJnBOwlFTaGkOiAfNVZSVBV+UdvrEFp7hKR:a0sUApoayvhBnOCGGiAfnWBjvrEH76
TLSH
T10A846C117601D37AE56300B1ABBE86BD96B86939075520C3E3C84DB95FBD6E27A3130F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

18:b3:4a:6b:1d:d6:db:8c:33:6d:48:96:37:3a:07:fb:9c:ab:59:1d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Chains

Dec 3, 2010

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Intel Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=ISWQL,O=Intel Corporation,L=Folsom,ST=California,C=US

Serial Number

48:ee:2c:9d:ad:71:45:09:44:a1:13:71:a8:0c:00:69

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 21, 2008 - Apr 23, 2011

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

Major OS version

Entry point

190872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\ccViews\autobuild1_BR-1012-00KP_7.1_Snapshot\AMT_Development\SW\Src\Services\LMS\Release\LMS.pdb

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailA

ws2_32

htons connect select __WSAFDIsSet ioctlsocket bind listen socket setsockopt WSAAccept freeaddrinfo accept shutdown closesocket getsockname WSAStartup ntohl htonl ntohs WSACreateEvent WSAGetLastError WSACloseEvent WSAResetEvent WSAAddressToStringA WSASetEvent recv send getpeername getaddrinfo

iphlpapi

GetExtendedTcpTable GetAdaptersAddresses NotifyAddrChange SetTcpEntry

dnsapi

DnsModifyRecordsInSet_A

crypt32

CryptProtectData CryptUnprotectData

kernel32

VirtualAlloc HeapReAlloc HeapCreate HeapSize GetConsoleCP VirtualFree GetLastError WaitForSingleObject FormatMessageA GetComputerNameExA CreateEventA DuplicateHandle GetCurrentProcess CloseHandle SetEvent ResetEvent CreateFileA GetOverlappedResult GetConsoleMode WriteFile DeviceIoControl FreeLibrary GetProcAddress LoadLibraryA GetModuleFileNameA Sleep GetVersionExA GetModuleHandleA SetConsoleCtrlHandler LocalFree GlobalFree GlobalAlloc GetStdHandle AllocConsole GetCurrentProcessId CreateSemaphoreA ReleaseSemaphore GetCurrentThreadId ResumeThread GetTickCount IsValidCodePage GetOEMCP GetACP ExitProcess GetStartupInfoA SetHandleCount FlushFileBuffers InitializeCriticalSectionAndSpinCount SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetProcessHeap GetSystemTimeAsFileTime GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA CompareStringW SetEnvironmentVariableA SetEndOfFile ReadFile InterlockedIncrement InterlockedDecrement WideCharToMultiByte InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar RtlUnwind HeapAlloc HeapFree ExitThread CreateThread RaiseException TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetStdHandle GetFileType DeleteFileA GetCommandLineA LCMapStringA LCMapStringW GetCPInfo GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError

user32

RegisterDeviceNotificationA DestroyWindow CreateWindowExA RegisterClassA UnregisterDeviceNotification DefWindowProcA

advapi32

CreateServiceA RegDeleteKeyA RegOpenKeyExA RegQueryValueExA RegisterEventSourceA ReportEventA DeregisterEventSource SetServiceStatus RegisterServiceCtrlHandlerExA StartServiceA RegDeleteValueA OpenServiceA ControlService QueryServiceStatus DeleteService RegCreateKeyA RegSetValueExA RegCloseKey OpenSCManagerA ChangeServiceConfig2A CloseServiceHandle StartServiceCtrlDispatcherA GetUserNameA LookupAccountNameA IsValidSid GetLengthSid CopySid

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_61fab18520c9783cd6f00337c7644ec1_elex_floxif_remcos_stealc_stop

PE Signature issue

setupapi

ws2_32

iphlpapi

dnsapi

crypt32

kernel32

user32

advapi32

generic