2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop

General

Target
2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop
Size 321KB
Sample261102-v28mdavygv
SHA256 b97f6bd83d209512ed16fa721674dd9330724ef8bffad64f03d8372feaa8cc14
MD5 fb52f5793fcb0657ec60c59bcc0b002e
SHA1 8266dda62c224843c2528144e25933833691527b
SHA512 ba5a9c145c48bfbe806bac232b6c7edcadd415568d711480abce8b6d658df67ec0a05f51aa6c4aa529a4f0fbc5640887537ec830f4c4400e9df8d454c62ca843
SSDEEP 6144:EEGT3NeCs0kow5aOUBGslQLwqYFBwuXdvQLNN/5yClc:EEGT3NeCs0wiGyiwqEwuXdvQ5N/Hl
TLSH
T13E649D18B9E0C175C18634B68969D7F259FDB5B01F6A72DBB7C809784F282D16A3230F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop

File Explorer

2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop

.exe 321KB

2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop

IMPHASH 7326b046df5362dffcee1945ef3033bd
SHA256 b97f6bd83d209512ed16fa721674dd9330724ef8bffad64f03d8372feaa8cc14
MD5 fb52f5793fcb0657ec60c59bcc0b002e
SHA1 8266dda62c224843c2528144e25933833691527b
SHA512 ba5a9c145c48bfbe806bac232b6c7edcadd415568d711480abce8b6d658df67ec0a05f51aa6c4aa529a4f0fbc5640887537ec830f4c4400e9df8d454c62ca843
SSDEEP 6144:EEGT3NeCs0kow5aOUBGslQLwqYFBwuXdvQLNN/5yClc:EEGT3NeCs0wiGyiwqEwuXdvQ5N/Hl
TLSH
T13E649D18B9E0C175C18634B68969D7F259FDB5B01F6A72DBB7C809784F282D16A3230F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

128286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress GetModuleHandleA GetSystemTimeAsFileTime GetLastError HeapFree HeapAlloc FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA GetModuleHandleW Sleep ExitProcess TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA EnterCriticalSection LeaveCriticalSection RaiseException RtlUnwind HeapCreate HeapDestroy VirtualFree DeleteCriticalSection FatalAppExitA VirtualAlloc HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread WriteFile GetStdHandle GetModuleFileNameA GetFullPathNameA GetCurrentDirectoryA SetCurrentDirectoryA SetConsoleCtrlHandler FreeLibrary InterlockedExchange LoadLibraryA InitializeCriticalSectionAndSpinCount WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers SetHandleCount GetFileType CloseHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation LCMapStringA MultiByteToWideChar LCMapStringW HeapSize GetLocaleInfoW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetFilePointer SetStdHandle CreateFileA GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale SetEndOfFile GetProcessHeap ReadFile CompareStringA CompareStringW SetEnvironmentVariableA

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_fb52f5793fcb0657ec60c59bcc0b002e_elex_redline-stealer_remcos_stop

kernel32

generic