2026-07-20_f61f27073576e1beccf50b3ebc5b908b_amadey_elex_remcos_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_f61f27073576e1beccf50b3ebc5b908b_amadey_elex_remcos_stealc_stop
Size 553KB
Sample260720-t8fdqsas2y
SHA256 097d5c3cf6fb9766750622d7f4f0a985b7faf0e019e86272c3aafebb487240ce
MD5 f61f27073576e1beccf50b3ebc5b908b
SHA1 48602999ce70ece171cc3ffcfbb288190ad8e647
SHA512 9923bcf1493fe07f38f159a86b6aa108beba4fde54c43e8ccd0f05d91ee5077d9a99fe626dfb5b9104315944efa0d229fd8c918cce67a13870bfc56eeb2dd4a4
SSDEEP 6144:eU/v65bvIZRE2wQNyHzXMqenbkkff/zIb6J28AOM+1U0OM2x1aG6c:J/v61IZREIyAlnb/fUchCFzoG6c
TLSH
T1C9C4AE1AFFC4C1B1C5652974866FABB7AA3E5760177026D7E3E0195C2E303F06A3A346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_f61f27073576e1beccf50b3ebc5b908b_amadey_elex_remcos_stealc_stop

File Explorer

2026-07-20_f61f27073576e1beccf50b3ebc5b908b_amadey_elex_remcos_stealc_stop

.exe 553KB

2026-07-20_f61f27073576e1beccf50b3ebc5b908b_amadey_elex_remcos_stealc_stop

IMPHASH 0d62927068e190cab1e48fb52fa41b96
SHA256 097d5c3cf6fb9766750622d7f4f0a985b7faf0e019e86272c3aafebb487240ce
MD5 f61f27073576e1beccf50b3ebc5b908b
SHA1 48602999ce70ece171cc3ffcfbb288190ad8e647
SHA512 9923bcf1493fe07f38f159a86b6aa108beba4fde54c43e8ccd0f05d91ee5077d9a99fe626dfb5b9104315944efa0d229fd8c918cce67a13870bfc56eeb2dd4a4
SSDEEP 6144:eU/v65bvIZRE2wQNyHzXMqenbkkff/zIb6J28AOM+1U0OM2x1aG6c:J/v61IZREIyAlnb/fUchCFzoG6c
TLSH
T1C9C4AE1AFFC4C1B1C5652974866FABB7AA3E5760177026D7E3E0195C2E303F06A3A346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

582656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

dinput8

DirectInput8Create

dsound

ord11

ddraw

DirectDrawCreateEx

winmm

timeBeginPeriod timeGetTime mmioOpenA mmioDescend mmioRead mmioAscend mmioSeek mmioGetInfo mmioAdvance mmioSetInfo

kernel32

GetModuleHandleA CloseHandle PurgeComm SetCommMask ClearCommError GetOverlappedResult GetLastError WriteFile ReadFile WaitCommEvent CreateEventA CreateThread SetCommTimeouts SetCommState GetCommState CreateFileA SetFilePointer MultiByteToWideChar WideCharToMultiByte GetTickCount LeaveCriticalSection EnterCriticalSection CreateDirectoryA InitializeCriticalSection SetLocalTime GetLocalTime SetEvent WaitForSingleObject ResetEvent GetCommMask GetCommTimeouts GetCurrentProcess DeleteFileA GetPrivateProfileStringA Sleep GetDriveTypeA GetStringTypeW GetStringTypeA GetLocaleInfoA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetProcessHeap SetEndOfFile LCMapStringW LCMapStringA GetTimeZoneInformation FlushFileBuffers IsValidCodePage GetOEMCP GetACP GetCPInfo LoadLibraryA SetStdHandle GetFullPathNameA InterlockedDecrement InitializeCriticalSectionAndSpinCount HeapSize GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP CompareStringA CompareStringW GetCurrentThreadId HeapFree HeapAlloc FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA RaiseException RtlUnwind SetEnvironmentVariableA GetCurrentDirectoryA GetSystemTimeAsFileTime GetFileInformationByHandle PeekNamedPipe GetFileType GetCommandLineA GetStartupInfoA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree DeleteCriticalSection VirtualAlloc HeapReAlloc GetModuleHandleW GetProcAddress ExitProcess GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError SetHandleCount

user32

DispatchMessageA PostQuitMessage ChangeDisplaySettingsA PostMessageA SetRect UpdateWindow ShowWindow CreateWindowExA GetAsyncKeyState LoadStringA ShowCursor PeekMessageA GetMessageA TranslateMessage MessageBoxA LoadIconA LoadCursorA RegisterClassExA DefWindowProcA ExitWindowsEx SystemParametersInfoA

gdi32

CreateFontA DeleteObject

advapi32

LookupPrivilegeValueA OpenProcessToken AdjustTokenPrivileges

ws2_32

htons

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_f61f27073576e1beccf50b3ebc5b908b_amadey_elex_remcos_stealc_stop

dinput8

dsound

ddraw

winmm

kernel32

user32

gdi32

advapi32

ws2_32

generic