2026-10-22_6499c1ef43e7e7b7eb3534b200b0284a_elex_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_6499c1ef43e7e7b7eb3534b200b0284a_elex_stop
Size 619KB
Sample261024-mvfc9abs6r
SHA256 a83babb20540528ab3b67ff5481c1d4b5d8be5a034d7f199590c8b191684873b
MD5 6499c1ef43e7e7b7eb3534b200b0284a
SHA1 85d68461e861322b042cc77624ab0d51ff033bec
SHA512 b974eb8c7a144e9e539c79d09b6ea5a67a81f1603d0980dc8cf0e775a220711ffb54a245d870d33e3174660d88383da8a6e66f987bd8e15a6d2f6b8d7da2dd50
SSDEEP 12288:MMl23+mvm27FPL/Nr5IpuL9KEiLQXCsqn6eVhFnvtdn7DMlXNT:MMl23+mmwKvLQXCs+6eVhFvslX5
TLSH
T105D4AD1279D08337E24652BA8B03D72B2AB77CF41468954BB9D036B97E34352E72874F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_6499c1ef43e7e7b7eb3534b200b0284a_elex_stop

File Explorer

2026-10-22_6499c1ef43e7e7b7eb3534b200b0284a_elex_stop

.exe 619KB

2026-10-22_6499c1ef43e7e7b7eb3534b200b0284a_elex_stop

IMPHASH bc4e243c863a6cf55692099ebe0e56f7
SHA256 a83babb20540528ab3b67ff5481c1d4b5d8be5a034d7f199590c8b191684873b
MD5 6499c1ef43e7e7b7eb3534b200b0284a
SHA1 85d68461e861322b042cc77624ab0d51ff033bec
SHA512 b974eb8c7a144e9e539c79d09b6ea5a67a81f1603d0980dc8cf0e775a220711ffb54a245d870d33e3174660d88383da8a6e66f987bd8e15a6d2f6b8d7da2dd50
SSDEEP 12288:MMl23+mvm27FPL/Nr5IpuL9KEiLQXCsqn6eVhFnvtdn7DMlXNT:MMl23+mmwKvLQXCs+6eVhFvslX5
TLSH
T105D4AD1279D08337E24652BA8B03D72B2AB77CF41468954BB9D036B97E34352E72874F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

215465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\360Game\trunk\src\release\sesvc.pdb

kernel32

Sleep TerminateThread SuspendThread WaitForSingleObject SystemTimeToFileTime SetEndOfFile TlsFree TlsAlloc TlsSetValue IsBadWritePtr IsBadReadPtr WriteFile SetFileTime ResetEvent GetTickCount CreateEventW SetWaitableTimer CreateWaitableTimerW GetDiskFreeSpaceExW GetTempFileNameW CancelWaitableTimer WaitForMultipleObjects GetShortPathNameW CreateDirectoryW SearchPathW FindClose FindNextFileW FindFirstFileW RemoveDirectoryW SetFileAttributesW GetFileAttributesW DeviceIoControl GetVersionExW MoveFileExW lstrcmpA SetLastError TerminateProcess OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot GetCommandLineW GetPrivateProfileIntW WritePrivateProfileStringW ExpandEnvironmentStringsW GetModuleHandleA SetProcessWorkingSetSize ExitProcess GlobalUnlock GlobalLock GlobalFree SetEvent VirtualQuery FileTimeToLocalFileTime GetFileTime LoadLibraryExW SetErrorMode HeapFree HeapAlloc GetProcessHeap DuplicateHandle GetWindowsDirectoryW GetSystemInfo OutputDebugStringW GetSystemTimeAsFileTime GetPrivateProfileStringW CompareStringW CompareStringA GetLocaleInfoW CreateFileA LoadLibraryA InterlockedExchange SetConsoleCtrlHandler InitializeCriticalSectionAndSpinCount WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetStringTypeW GetStringTypeA GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA SetStdHandle HeapReAlloc FatalAppExitA HeapDestroy HeapCreate DeleteCriticalSection GetFileType GetStdHandle SetHandleCount GetCurrentProcess GlobalAlloc InterlockedIncrement DebugBreak InterlockedDecrement GetLastError ReadFile SetFilePointer VirtualAlloc VirtualFree FindResourceW LoadResource MultiByteToWideChar SizeofResource DeleteFileW FreeLibrary GetTempPathW GetModuleFileNameW GetSystemDirectoryW CopyFileW CreateFileW GetFileSize CreateFileMappingW MapViewOfFile GetCurrentThread lstrlenW lstrlenA UnmapViewOfFile GetModuleHandleW LoadLibraryW GetTimeZoneInformation HeapSize GetConsoleMode GetConsoleCP LeaveCriticalSection EnterCriticalSection LCMapStringW LCMapStringA TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo GetStartupInfoA GetCommandLineA CreateThread GetCurrentThreadId ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlUnwind RaiseException GetProcAddress CloseHandle WideCharToMultiByte GetProcessTimes SetEnvironmentVariableA

user32

GetDesktopWindow FillRect SetRect InvalidateRect wvsprintfW CharNextW SetWindowPos GetSystemMetrics GetWindowRect GetParent SendMessageW FindWindowW ReleaseDC DrawTextW GetDC GetKeyNameTextW MapVirtualKeyW CloseClipboard GetClipboardData OpenClipboard IsClipboardFormatAvailable SetClipboardData EmptyClipboard CopyRect GetMonitorInfoW MonitorFromWindow MonitorFromPoint ShowWindow DispatchMessageW TranslateMessage GetWindowThreadProcessId PostQuitMessage FindWindowExW SubtractRect PeekMessageW

gdi32

DeleteObject CreateSolidBrush

advapi32

RegDeleteKeyW LookupPrivilegeValueW OpenProcessToken FreeSid GetSidIdentifierAuthority GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation CopySid RegSetKeySecurity RegQueryInfoKeyW RegEnumKeyW GetLengthSid InitializeAcl AddAce InitializeSecurityDescriptor SetSecurityDescriptorDacl RegGetKeySecurity RegEnumKeyExW RegDeleteValueW RegOpenKeyExW RegCloseKey RegQueryValueExW AllocateAndInitializeSid CheckTokenMembership AdjustTokenPrivileges

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetSpecialFolderPathW SHFreeNameMappings SHFileOperationW ord680 ShellExecuteExW ShellExecuteW SHAppBarMessage SHGetSpecialFolderLocation SHGetFileInfoW

ole32

CoTaskMemFree OleInitialize OleUninitialize CoUninitialize CoCreateInstance CoInitialize

oleaut32

SysAllocString SysFreeString

shlwapi

PathFindFileNameA PathGetDriveNumberW PathFindExtensionW PathAppendW SHSetValueW StrCmpIW PathFindFileNameW PathFileExistsW PathRemoveFileSpecW SHGetValueW PathIsRootW PathCombineW StrStrIW PathIsURLW StrStrIA

wininet

InternetCrackUrlW HttpQueryInfoW FtpGetFileSize FtpCommandW InternetGetLastResponseInfoW InternetSetOptionA InternetConnectW InternetSetStatusCallbackW InternetOpenW InternetSetOptionW HttpSendRequestExW HttpOpenRequestW InternetQueryOptionW InternetCloseHandle InternetWriteFile InternetReadFileExA InternetReadFile HttpEndRequestW FtpOpenFileW

psapi

GetModuleFileNameExW EnumProcessModules

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

setupapi

SetupIterateCabinetW

comctl32

ImageList_Remove ImageList_Duplicate InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_6499c1ef43e7e7b7eb3534b200b0284a_elex_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

psapi

version

setupapi

comctl32

generic