2026-08-03_85a23f8d3615f3c9e3480d3e5fa944ae_amadey_elex_redline-stealer_remcos_smoke-loader_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_85a23f8d3615f3c9e3480d3e5fa944ae_amadey_elex_redline-stealer_remcos_smoke-loader_stealc
Size 964KB
Sample260804-m43vxatzcy
SHA256 abf8db13e2af894daff233b5eb634977c748dd9ade73eb4c8f3478ac7a18fd98
MD5 85a23f8d3615f3c9e3480d3e5fa944ae
SHA1 789388fedc89d6ba7091ad045a899aa8d5c211a6
SHA512 644d75d1eab08b2d456b1fe9db94a982f77b2b25d550fbf9ebb18daa7ac380a5e2d5c13337e4d3623de9a0d8a4b1f7c665b6a56bd4007b816bf9562bf3abe865
SSDEEP 24576:4HRyazJSmVkXk/Nb/N9HNMelzoG7HXntot:4HS0/R/jKeeGTXntot
TLSH
T1D825AE50B500C676DAA26670C97F9FBF1529E611172996C7B3DC0E2A2C707E21B3638F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_85a23f8d3615f3c9e3480d3e5fa944ae_amadey_elex_redline-stealer_remcos_smoke-loader_stealc

File Explorer

2026-08-03_85a23f8d3615f3c9e3480d3e5fa944ae_amadey_elex_redline-stealer_remcos_smoke-loader_stealc

.exe 964KB

2026-08-03_85a23f8d3615f3c9e3480d3e5fa944ae_amadey_elex_redline-stealer_remcos_smoke-loader_stealc

IMPHASH aa866537b644c31903c1d35ff9b05b13
SHA256 abf8db13e2af894daff233b5eb634977c748dd9ade73eb4c8f3478ac7a18fd98
MD5 85a23f8d3615f3c9e3480d3e5fa944ae
SHA1 789388fedc89d6ba7091ad045a899aa8d5c211a6
SHA512 644d75d1eab08b2d456b1fe9db94a982f77b2b25d550fbf9ebb18daa7ac380a5e2d5c13337e4d3623de9a0d8a4b1f7c665b6a56bd4007b816bf9562bf3abe865
SSDEEP 24576:4HRyazJSmVkXk/Nb/N9HNMelzoG7HXntot:4HS0/R/jKeeGTXntot
TLSH
T1D825AE50B500C676DAA26670C97F9FBF1529E611172996C7B3DC0E2A2C707E21B3638F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

588655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\Alawar\Holiday_Resort\Game\SummerResortMogul.pdb

d3d8

Direct3DCreate8

dinput8

DirectInput8Create

dsound

ord11

psapi

EnumProcesses EnumProcessModules GetModuleBaseNameW

kernel32

CloseHandle OpenProcess GetCurrentProcessId GetCurrentProcess DeleteFileW CreateDirectoryW MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter Sleep GetModuleHandleW QueryPerformanceFrequency SetThreadAffinityMask GetCurrentThread CreateProcessW LoadLibraryA GetProcAddress GetModuleHandleA WriteFile GetLastError CreateFileA CreateFileW GetVersionExA UnmapViewOfFile HeapReAlloc CompareStringW GetStringTypeW LCMapStringW WriteConsoleW FlushFileBuffers SetStdHandle HeapSize IsValidCodePage GetOEMCP GetACP GetCPInfo GetSystemTimeAsFileTime GetTickCount GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA HeapCreate ReadFile SetFilePointer GetFileType SetHandleCount GetModuleFileNameW GetStdHandle InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue SetEnvironmentVariableA TlsGetValue TlsAlloc IsProcessorFeaturePresent SetEndOfFile GetProcessHeap LoadLibraryW ExitProcess DecodePointer RtlUnwind HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW EnterCriticalSection LeaveCriticalSection TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer RaiseException GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount DeleteCriticalSection

user32

ShowCursor ClientToScreen SetCursorPos GetKeyboardState ToUnicode PeekMessageW TranslateMessage DispatchMessageW LoadIconW LoadCursorW RegisterClassW CreateWindowExW DefWindowProcW GetCursorInfo SetWindowLongW SetWindowPos GetClientRect GetWindowRect PostQuitMessage GetSystemMetrics AdjustWindowRectEx ChangeDisplaySettingsW ReleaseDC DestroyWindow UnregisterClassW MessageBoxW FindWindowW ShowWindow SetFocus PtInRect MapWindowPoints GetWindowLongW GetCursorPos

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyA

shell32

SHGetFolderPathW ShellExecuteA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_85a23f8d3615f3c9e3480d3e5fa944ae_amadey_elex_redline-stealer_remcos_smoke-loader_stealc

d3d8

dinput8

dsound

psapi

kernel32

user32

advapi32

shell32

generic