2026-08-08_da487127b15ac1a82f23aa186fb60d40_amadey_elex_floxif_hellokitty_manuscrypt_remcos

General

Target
2026-08-08_da487127b15ac1a82f23aa186fb60d40_amadey_elex_floxif_hellokitty_manuscrypt_remcos
Size 206KB
Sample260808-xc951ssgla
SHA256 c120257fad4ae4718fd52ed36117a799ca0bbb01d6ed53bd9b23f84cc2eeb50e
MD5 da487127b15ac1a82f23aa186fb60d40
SHA1 ba4c79560ac1ad3addbb457ea1db0ca8aaed2ab9
SHA512 883f566e0591ec8ba2546815e1bea9344af3ae7a4b5226f881af697cc0a81589857efd38ae9052359f0548664500a4bfb7912c60abeee12b4883dbe8a31b5ddb
SSDEEP 3072:GEO93q9pOW1GJri8OioDw7LC89IAFF5J7P0372lQBV+UdE+rECWp7hKdI:GEO93q9rwll5Vc3/BV+UdvrEFp7hKi
TLSH
T180244A4077C1F3E4E2650830B4649AF04599BF3CC96A595BE2413E3A3A3CD93BFD691A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_da487127b15ac1a82f23aa186fb60d40_amadey_elex_floxif_hellokitty_manuscrypt_remcos

File Explorer

2026-08-08_da487127b15ac1a82f23aa186fb60d40_amadey_elex_floxif_hellokitty_manuscrypt_remcos

.exe 206KB

2026-08-08_da487127b15ac1a82f23aa186fb60d40_amadey_elex_floxif_hellokitty_manuscrypt_remcos

IMPHASH de96d31eae7e9082fa15ac882283119d
SHA256 c120257fad4ae4718fd52ed36117a799ca0bbb01d6ed53bd9b23f84cc2eeb50e
MD5 da487127b15ac1a82f23aa186fb60d40
SHA1 ba4c79560ac1ad3addbb457ea1db0ca8aaed2ab9
SHA512 883f566e0591ec8ba2546815e1bea9344af3ae7a4b5226f881af697cc0a81589857efd38ae9052359f0548664500a4bfb7912c60abeee12b4883dbe8a31b5ddb
SSDEEP 3072:GEO93q9pOW1GJri8OioDw7LC89IAFF5J7P0372lQBV+UdE+rECWp7hKdI:GEO93q9rwll5Vc3/BV+UdvrEFp7hKi
TLSH
T180244A4077C1F3E4E2650830B4649AF04599BF3CC96A595BE2413E3A3A3CD93BFD691A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9043

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Thomas\GitWorkspace\META\QT_META\META\output\META.pdb

shlwapi

PathRemoveFileSpecW PathCombineW PathQuoteSpacesW

kernel32

GetStdHandle DecodePointer WriteConsoleW SetFilePointerEx FindFirstFileW FindNextFileW GetModuleFileNameW FindClose WaitForSingleObject GetLastError CloseHandle CreateProcessW GetExitCodeProcess GetConsoleMode UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW MultiByteToWideChar WideCharToMultiByte CreateFileW WriteFile ExitProcess GetModuleHandleExW GetACP HeapAlloc HeapFree SetEnvironmentVariableA SetEnvironmentVariableW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringW LCMapStringW SetStdHandle GetFileType GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_da487127b15ac1a82f23aa186fb60d40_amadey_elex_floxif_hellokitty_manuscrypt_remcos

shlwapi

kernel32

generic