2026-11-02_f60c78a6288d89687ae5fa0f65c0dfe1_elex_floxif_remcos_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_f60c78a6288d89687ae5fa0f65c0dfe1_elex_floxif_remcos_rhadamanthys_stop
Size 489KB
Sample261102-wmshaad13p
SHA256 6ec20dcd1eec0c4f157060ee5c090a097538c3a6fd8fa06a8ebf6e4acd4fdd68
MD5 f60c78a6288d89687ae5fa0f65c0dfe1
SHA1 36931920db11487943da64c7c9a9b3df5a0426ff
SHA512 2c862b980637091bd6a94acde6eeb5d02fefc192deee2d0d3efcd651372175c778c116e39fbfddd3f8b163eae4f53bd9d16e3699347b0e8d3a8ef8c14f8de2ce
SSDEEP 12288:LqyjRC28CyNYAvoOcDG2V2+qjfxWrrMMDMMM6s7A7vBjvrEH7f:GtYw52V2+qQrrMMDMMM6s7A7drEH7f
TLSH
T145B4AE103BC4C3B6D29110327AA9D775A5EDAD390F3541C7B3D03A6C9E78AD2AA38717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-02_f60c78a6288d89687ae5fa0f65c0dfe1_elex_floxif_remcos_rhadamanthys_stop

File Explorer

2026-11-02_f60c78a6288d89687ae5fa0f65c0dfe1_elex_floxif_remcos_rhadamanthys_stop

.exe 489KB

2026-11-02_f60c78a6288d89687ae5fa0f65c0dfe1_elex_floxif_remcos_rhadamanthys_stop

IMPHASH 263c96521f3f212d2967b32a1c07bf12
SHA256 6ec20dcd1eec0c4f157060ee5c090a097538c3a6fd8fa06a8ebf6e4acd4fdd68
MD5 f60c78a6288d89687ae5fa0f65c0dfe1
SHA1 36931920db11487943da64c7c9a9b3df5a0426ff
SHA512 2c862b980637091bd6a94acde6eeb5d02fefc192deee2d0d3efcd651372175c778c116e39fbfddd3f8b163eae4f53bd9d16e3699347b0e8d3a8ef8c14f8de2ce
SSDEEP 12288:LqyjRC28CyNYAvoOcDG2V2+qjfxWrrMMDMMM6s7A7vBjvrEH7f:GtYw52V2+qQrrMMDMMM6s7A7drEH7f
TLSH
T145B4AE103BC4C3B6D29110327AA9D775A5EDAD390F3541C7B3D03A6C9E78AD2AA38717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

72:08:29:0e:d1:01:c1:98:73:e0:97:e9:2e:71:4b:20:a7:8a:d3:29:5a:1d:e9:a4:da:0d:ec:f6:ba:9c:6d:d7

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

Jun 25, 2026

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

df:10:53:b2:a0:82:5e:84:9a:a9:85:5b:f9:16:e9:e3:40:d3:06:0e

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Chains

Jun 25, 2026

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=SEIKO EPSON CORPORATION,O=SEIKO EPSON CORPORATION,L=Suwa-Shi,ST=Nagano,C=JP

Serial Number

0e:ac:20:79:9d:aa:e6:4c:53:35:fa:d5:aa:7b:86:05

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 4, 2025 - Sep 15, 2026

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

140851

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Administrator\SoftwareUpdater\Ryoga\EPSDNMON\Release\EPSDNMON.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

SetFilePointer FlushFileBuffers SetEndOfFile GetFullPathNameW CreateFileW GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess GetSystemTimeAsFileTime HeapReAlloc RtlUnwind RaiseException GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW WriteFile SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation LCMapStringW GetTimeFormatA GetDateFormatA VirtualAlloc InitializeCriticalSectionAndSpinCount GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW SetStdHandle GetConsoleCP GetConsoleMode LCMapStringA GetCurrentDirectoryA GetDriveTypeA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA ReadFile GlobalFlags GetModuleHandleA TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc GetCurrentProcessId InterlockedDecrement InterlockedIncrement GlobalAddAtomW GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA lstrlenA GlobalDeleteAtom GetCurrentThreadId lstrcmpA GetLocaleInfoW CompareStringA FindFirstFileW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW FindClose GlobalLock GlobalUnlock FormatMessageW LocalFree lstrlenW Process32NextW Process32FirstW CreateToolhelp32Snapshot ReleaseMutex Sleep CreateMutexW DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW FreeLibrary DeleteFileW WritePrivateProfileStringW CopyFileW GetPrivateProfileIntW GetVersionExW CloseHandle GetLastError GetExitCodeProcess WaitForSingleObject CreateProcessW GetCurrentProcess GetModuleFileNameW GetPrivateProfileStringW SetLastError GetProcAddress GetModuleHandleW GlobalFree GetPrivateProfileSectionNamesW GlobalSize GlobalAlloc lstrcmpW GetTickCount GetTempPathW FindResourceW LoadResource LockResource SizeofResource WideCharToMultiByte MultiByteToWideChar HeapSize HeapFree HeapAlloc GetProcessHeap GetCommandLineW

user32

DestroyMenu ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW ValidateRect GetWindowThreadProcessId GetDC ReleaseDC GetSysColorBrush IsWindowEnabled SetWindowTextW SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem RegisterWindowMessageW WinHelpW GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW SetPropW GetPropW RemovePropW GetFocus IsWindow GetWindowTextW GetForegroundWindow GetLastActivePopup GetDlgItem UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetMenu SetForegroundWindow GetClientRect MessageBoxW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx GetParent GetDlgCtrlID SendMessageW CallWindowProcW CopyRect PtInRect GetMenu GetWindowLongW SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetSystemMetrics GetClassNameW GetWindow GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow DialogBoxParamW SetTimer CreateWindowExW FindWindowW RegisterClassExW LoadCursorW LoadIconW DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW LoadAcceleratorsW LoadStringW EnableWindow PostMessageW GetTopWindow

gdi32

DeleteDC GetStockObject Escape ExtTextOutW TextOutW RectVisible PtVisible ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx GetDeviceCaps DeleteObject SetMapMode RestoreDC SaveDC CreateBitmap SetBkColor SetTextColor GetClipBox SelectObject

winspool.drv

DocumentPropertiesW GetPrinterW GetPrinterDriverW OpenPrinterW EnumPrinterDriversW EnumPrintersW GetPrinterDataW ClosePrinter

shell32

SHGetMalloc SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteExW SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

wtsapi32

WTSEnumerateProcessesW WTSFreeMemory

oleaut32

VariantClear VariantChangeType VariantInit

oleacc

CreateStdAccessibleObject LresultFromObject

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_f60c78a6288d89687ae5fa0f65c0dfe1_elex_floxif_remcos_rhadamanthys_stop

PE Signature issue

PE Signature issue

version

kernel32

user32

gdi32

winspool.drv

shell32

shlwapi

wtsapi32

oleaut32

oleacc

generic