2026-11-12_1072e5f884b7c3f27d26232c8f26bae5_elex_manuscrypt_mespinoza_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_1072e5f884b7c3f27d26232c8f26bae5_elex_manuscrypt_mespinoza_remcos
Size 1.2MB
Sample261113-j6edjsst6q
SHA256 2f2d15fc869f238b08194d4ef4345a18c20e255d12109c62478cc5fb1c714a17
MD5 1072e5f884b7c3f27d26232c8f26bae5
SHA1 e97b18eb32820745c45f1621be94cf1fd3d1ce2e
SHA512 a8ff4d4d8d873f97c20e9f73b937c60df19af0d04bfa984e927d04a369a44ceb71e859a32365add032bcef643d78d1a651a21294d0bbee47a7c1875b7e923f7e
SSDEEP 12288:+JRAdCVCn8G1I3grnnzd51YLEIebR/1MMnUa:wRAdCo1znzd7YLjeb9CA5
TLSH
T16145AE823BD9D4A3C42396750679CDB69D2EF9103BEB24EB390753290B941CFCD315AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_1072e5f884b7c3f27d26232c8f26bae5_elex_manuscrypt_mespinoza_remcos

File Explorer

2026-11-12_1072e5f884b7c3f27d26232c8f26bae5_elex_manuscrypt_mespinoza_remcos

.exe 1.2MB

2026-11-12_1072e5f884b7c3f27d26232c8f26bae5_elex_manuscrypt_mespinoza_remcos

IMPHASH 02d1db3ebd7f9efaa3c033869f76eace
SHA256 2f2d15fc869f238b08194d4ef4345a18c20e255d12109c62478cc5fb1c714a17
MD5 1072e5f884b7c3f27d26232c8f26bae5
SHA1 e97b18eb32820745c45f1621be94cf1fd3d1ce2e
SHA512 a8ff4d4d8d873f97c20e9f73b937c60df19af0d04bfa984e927d04a369a44ceb71e859a32365add032bcef643d78d1a651a21294d0bbee47a7c1875b7e923f7e
SSDEEP 12288:+JRAdCVCn8G1I3grnnzd51YLEIebR/1MMnUa:wRAdCo1znzd7YLjeb9CA5
TLSH
T16145AE823BD9D4A3C42396750679CDB69D2EF9103BEB24EB390753290B941CFCD315AA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35484

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\AllMyProjects\Cryptor\build\vc14-x86\bin\Release\TemplatelExeFile.pdb

kernel32

GetModuleHandleW HeapAlloc CloseHandle CreateEventA InitializeCriticalSectionAndSpinCount GetLastError SetEvent GetProcAddress DecodePointer HeapFree WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers RaiseException LoadLibraryA GetStringTypeW SetStdHandle DeleteCriticalSection GetProcessHeap GetSystemTimeAsFileTime OpenEventA WaitForSingleObjectEx ReleaseSemaphore GetCurrentProcessId GetCurrentThreadId ResetEvent ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree LocalFree FormatMessageA IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead EncodePointer RtlUnwind FreeLibrary LoadLibraryExW SetLastError QueryPerformanceFrequency CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetStdHandle WriteFile GetACP LCMapStringW HeapSize HeapReAlloc FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType CreateFileW

user32

ReleaseDC GetDC MessageBoxA

gdi32

GetStockObject

shell32

SHChangeNotify SHBindToParent SHGetFolderPathW

advapi32

RegOpenKeyExW

Name

.text

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.mt

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_MEM_READ

Name

.dg

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_1072e5f884b7c3f27d26232c8f26bae5_elex_manuscrypt_mespinoza_remcos

kernel32

user32

gdi32

shell32

advapi32

generic