General
- Target 2026-10-22_439988fae7e9d76aa3b17c3c6018dd9e_elex_icloader_remcos_stop
- Size 2.0MB
- Sample261024-sfnc7sfb72
- SHA256 d81d1b4787caf13c956f1c6d8d59d4f4973ef3c4fd2cbafd5723a7426d832772
- MD5 439988fae7e9d76aa3b17c3c6018dd9e
- SHA1 47d6789086a4e49b0e1e44c636d66a5ccbe85241
- SHA512 c779d77f6ab4f6b317ad7216302e0e350bb8ccec19652fa570d8ea8638aa6fe37cd80af03bd784108e840e6b328b25cde6892f6550e28ecd37ffbc67fe2fe1fb
- SSDEEP 49152:Ph/VNnrhAfEWDzPDsPGmt4SO+eMVwKFG:J/zi8WToPGmtGMtG
- TLSH T183A502A3F3C588B8D5A681B249FA04649836BD551733DF9F364CE42D6FB8A90D932343
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_439988fae7e9d76aa3b17c3c6018dd9e_elex_icloader_remcos_stop.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_439988fae7e9d76aa3b17c3c6018dd9e_elex_icloader_remcos_stop.exe
Resource
win11ltsc2024-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_439988fae7e9d76aa3b17c3c6018dd9e_elex_icloader_remcos_stop
- Size 2.0MB
- SHA256 d81d1b4787caf13c956f1c6d8d59d4f4973ef3c4fd2cbafd5723a7426d832772
- MD5 439988fae7e9d76aa3b17c3c6018dd9e
- SHA1 47d6789086a4e49b0e1e44c636d66a5ccbe85241
- SHA512 c779d77f6ab4f6b317ad7216302e0e350bb8ccec19652fa570d8ea8638aa6fe37cd80af03bd784108e840e6b328b25cde6892f6550e28ecd37ffbc67fe2fe1fb
- SSDEEP 49152:Ph/VNnrhAfEWDzPDsPGmt4SO+eMVwKFG:J/zi8WToPGmtGMtG
- TLSH T183A502A3F3C588B8D5A681B249FA04649836BD551733DF9F364CE42D6FB8A90D932343
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
MITRE ATT&CK Enterprise v16
Defense Evasion
Direct Volume Access
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1