2026-10-30_e4c7f725d2d3cd80cf07e08b1b8248e6_elex_floxif_remcos_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_e4c7f725d2d3cd80cf07e08b1b8248e6_elex_floxif_remcos_rhadamanthys_stop
Size 535KB
Sample261031-wsbrqaaa72
SHA256 ca9f6473c6d1bf553a61e900a16679d42d8fa488fa2ad73231ffc4e769c9bb46
MD5 e4c7f725d2d3cd80cf07e08b1b8248e6
SHA1 9f7558e7919f47b5fd6952933e91c7e845f118aa
SHA512 190188852af3b5bd328f93cf79d19e3a2a3c178b6efa5fe838f95bb6ce2347128a6d204ec035d5ed9982cd10745ad3b6c3d4a7d5d0325b6626db592a78a605f6
SSDEEP 12288:mNyfgWkbkX6Iuvi8VI7i3ZGKRKVKzKRiStZO767QBjvrEH7R:mNe6Vi8VI7dKRKVKzKRjs767SrEH7R
TLSH
T16CC4C0217BC4C27AD2A210326AAAD735B5F9BD350B3541C773C03A6C5E786D2AE38717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-30_e4c7f725d2d3cd80cf07e08b1b8248e6_elex_floxif_remcos_rhadamanthys_stop

File Explorer

2026-10-30_e4c7f725d2d3cd80cf07e08b1b8248e6_elex_floxif_remcos_rhadamanthys_stop

.exe 535KB

2026-10-30_e4c7f725d2d3cd80cf07e08b1b8248e6_elex_floxif_remcos_rhadamanthys_stop

IMPHASH ef4cc364378f415df914deb271348a45
SHA256 ca9f6473c6d1bf553a61e900a16679d42d8fa488fa2ad73231ffc4e769c9bb46
MD5 e4c7f725d2d3cd80cf07e08b1b8248e6
SHA1 9f7558e7919f47b5fd6952933e91c7e845f118aa
SHA512 190188852af3b5bd328f93cf79d19e3a2a3c178b6efa5fe838f95bb6ce2347128a6d204ec035d5ed9982cd10745ad3b6c3d4a7d5d0325b6626db592a78a605f6
SSDEEP 12288:mNyfgWkbkX6Iuvi8VI7i3ZGKRKVKzKRiStZO767QBjvrEH7R:mNe6Vi8VI7dKRKVKzKRjs767SrEH7R
TLSH
T16CC4C0217BC4C27AD2A210326AAAD735B5F9BD350B3541C773C03A6C5E786D2AE38717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

40:48:e9:30:3a:42:55:bb:e6:22:08:8c:26:14:83:a6:e9:aa:05:d8:42:04:3e:c1:64:e8:7b:db:ae:79:75:a2

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

Jun 2, 2026

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

46:01:0b:1e:05:13:e3:7e:25:cb:97:0d:df:7d:50:6d:22:06:79:54

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

Jun 2, 2026

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Serial Number

0e:ac:20:79:9d:aa:e6:4c:53:35:fa:d5:aa:7b:86:05

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 4, 2025 - Sep 15, 2026

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

157457

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\gitlab-runner\builds\9AAEqud-\0\git1\3327-WinPrinterDriver\v3printerdriver\application\vega\SourceV3\VegaMonitor\Release\EPPCCMON.pdb

wtsapi32

WTSFreeMemory WTSEnumerateProcessesW

kernel32

ReadFile WriteFile SetFilePointer FlushFileBuffers SetEndOfFile GetFullPathNameW CreateFileW GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapReAlloc RtlUnwind RaiseException ExitThread CreateThread ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW VirtualAlloc GetTimeZoneInformation InitializeCriticalSectionAndSpinCount LCMapStringA GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetConsoleCP GetConsoleMode SetStdHandle GetCurrentDirectoryA GetDriveTypeA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA WritePrivateProfileStringW GetModuleHandleA GlobalFlags InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalReAlloc TlsGetValue LocalAlloc SetErrorMode GetCurrentProcessId GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW CompareStringA InterlockedExchange lstrlenA lstrcmpA SuspendThread SetEvent SetThreadPriority GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW LoadLibraryA GetVersionExA FreeResource FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW FormatMessageW LocalFree MulDiv SetLastError GetExitCodeThread GetCommandLineW GetPrivateProfileIntW CreateFileMappingW FlushViewOfFile UnmapViewOfFile MapViewOfFile GetUserDefaultLangID InterlockedDecrement WaitForMultipleObjects CreateEventW OutputDebugStringW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ResumeThread CloseHandle ReleaseMutex GetModuleFileNameW GetFileAttributesW GetExitCodeProcess GetModuleHandleW WaitForSingleObject GlobalSize GetCurrentProcess CreateMutexW GetPrivateProfileSectionNamesW GlobalHandle FindClose GlobalFree GetLastError GlobalUnlock lstrlenW lstrcmpW GetVersionExW Sleep GetSystemDirectoryW GlobalAlloc GlobalLock FindFirstFileW HeapSize GetTempPathW WideCharToMultiByte GetTickCount LockResource GetProcAddress MultiByteToWideChar SizeofResource LoadLibraryW GetPrivateProfileStringW GetProcessHeap HeapFree HeapAlloc LoadResource FreeLibrary FindResourceW SetHandleCount

user32

GrayStringW DrawTextExW DrawTextW TabbedTextOutW ClientToScreen ReleaseDC GetSysColorBrush GetWindowThreadProcessId SetCursor GetCursorPos ValidateRect ShowWindow SetWindowTextW IsDialogMessageW SetDlgItemTextW RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW RemovePropW SetFocus GetWindowTextW GetForegroundWindow GetLastActivePopup GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos GetKeyState SetMenu SetForegroundWindow IsWindowVisible UpdateWindow PostMessageW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetDlgCtrlID CallWindowProcW PtInRect GetMenu SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetSysColor GetSystemMetrics DestroyMenu CopyRect GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW IsWindow GetDlgItem IsWindowEnabled GetNextDlgTabItem SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW CheckMenuItem GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu EndPaint DestroyWindow TranslateAcceleratorW SetTimer GetMessageW PostQuitMessage KillTimer DialogBoxParamW LoadCursorW BeginPaint LoadAcceleratorsW RegisterClassExW LoadIconW EndDialog LoadStringW CreateWindowExW DefWindowProcW MessageBoxW SendMessageW MsgWaitForMultipleObjects TranslateMessage PeekMessageW DispatchMessageW GetWindowRect GetClientRect GetDC GetWindowLongW SetWindowLongW MapWindowPoints GetPropW GetWindow MoveWindow GetSystemMenu EnableMenuItem EnableWindow

gdi32

GetStockObject Escape TextOutW RectVisible PtVisible ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx DeleteDC CreateDCW SetLayout SetMapMode RestoreDC SaveDC DeleteObject SetBkColor SetTextColor GetClipBox ExtTextOutW GetObjectW CreateBitmap GetDeviceCaps ExtEscape SelectObject

winspool.drv

EnumPortsW EnumPrintersW SetJobW GetPrinterW OpenPrinterW GetPrinterDriverW EnumJobsW ClosePrinter GetJobW DocumentPropertiesW

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegSetValueExW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

ShellExecuteExW SHGetSpecialFolderPathW

shlwapi

PathFindFileNameW PathFindExtensionW

wininet

HttpOpenRequestW HttpQueryInfoW InternetCloseHandle HttpSendRequestW InternetConnectW InternetReadFile InternetCrackUrlW InternetQueryDataAvailable InternetOpenW InternetSetOptionW

rpcrt4

UuidCreate

ole32

CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

VariantChangeType VarBstrCmp VariantInit SysAllocString SysAllocStringByteLen SysStringByteLen SysFreeString SysStringLen VariantClear

oleacc

CreateStdAccessibleObject LresultFromObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_e4c7f725d2d3cd80cf07e08b1b8248e6_elex_floxif_remcos_rhadamanthys_stop

PE Signature issue

PE Signature issue

wtsapi32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

wininet

rpcrt4

ole32

oleaut32

oleacc

generic