2026-08-09_e60db87f8122c1df0b5c6edb9ae5b41b_amadey_elex_floxif_remcos_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_e60db87f8122c1df0b5c6edb9ae5b41b_amadey_elex_floxif_remcos_rhadamanthys_stop
Size 414KB
Sample260809-qrf26afn6y
SHA256 a33b461c878d2b22a8a99c814d083bc932c5a5246322f5cbfc3a5eaef5c17ff8
MD5 e60db87f8122c1df0b5c6edb9ae5b41b
SHA1 e9ed20d9aabade490f8bc204a05e1d316472846f
SHA512 67816b560969f49de92f7e37ebce7b7c5d4643dbbb8d7b4b449c09ed8d110f36aac62ceaeb812f04629a0cd223d27cd000b36bd0c475b757b3e6e51c176d1d4c
SSDEEP 12288:Rxx8WEXHXSbZYhFyb1XhZYjaBpZBjvrEH7f:vxu5h0b1DYGHrEH7f
TLSH
T14C949F107794C3B2D5521535262AD77666FEBC381F2686C7B7903B2D6E382C2DE3870A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_e60db87f8122c1df0b5c6edb9ae5b41b_amadey_elex_floxif_remcos_rhadamanthys_stop

File Explorer

2026-08-09_e60db87f8122c1df0b5c6edb9ae5b41b_amadey_elex_floxif_remcos_rhadamanthys_stop

.exe 414KB

2026-08-09_e60db87f8122c1df0b5c6edb9ae5b41b_amadey_elex_floxif_remcos_rhadamanthys_stop

IMPHASH ae85381adfe87ea5935ab35a07986da1
SHA256 a33b461c878d2b22a8a99c814d083bc932c5a5246322f5cbfc3a5eaef5c17ff8
MD5 e60db87f8122c1df0b5c6edb9ae5b41b
SHA1 e9ed20d9aabade490f8bc204a05e1d316472846f
SHA512 67816b560969f49de92f7e37ebce7b7c5d4643dbbb8d7b4b449c09ed8d110f36aac62ceaeb812f04629a0cd223d27cd000b36bd0c475b757b3e6e51c176d1d4c
SSDEEP 12288:Rxx8WEXHXSbZYhFyb1XhZYjaBpZBjvrEH7f:vxu5h0b1DYGHrEH7f
TLSH
T14C949F107794C3B2D5521535262AD77666FEBC381F2686C7B7903B2D6E382C2DE3870A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

126851

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\work\cdrom\base\windows下iso光盘制作\源码\Windows端源码\NDIS_DRIVER_INSTALL2008\Bin\PackageOutPutPlace\FI_Eject.pdb

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

kernel32

ReadFile WriteFile SetFilePointer FlushFileBuffers SetEndOfFile TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException HeapReAlloc ExitProcess HeapSize SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetOEMCP IsValidCodePage LCMapStringW GetConsoleCP GetConsoleMode HeapCreate VirtualFree VirtualAlloc GetModuleFileNameA LCMapStringA GetStringTypeA GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA GlobalFlags GetModuleHandleA WritePrivateProfileStringW lstrlenA TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GetCurrentProcessId InterlockedDecrement InterlockedIncrement GlobalAddAtomW GlobalFindAtomW LoadLibraryA GetVersionExA SetErrorMode GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW InterlockedExchange lstrcmpW SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock lstrlenW Process32NextW OpenProcess Process32FirstW CreateToolhelp32Snapshot LocalFree FormatMessageW CreateThread ReleaseSemaphore CreateSemaphoreW WaitForSingleObject WideCharToMultiByte GetACP HeapFree GetProcessHeap HeapAlloc GetTickCount Sleep FindClose FindFirstFileW GetProcAddress FreeLibrary LoadLibraryW GetVersionExW GetModuleFileNameW SetEvent CreateEventW WaitForMultipleObjects OutputDebugStringW GetLocalTime DeviceIoControl CreateFileW CloseHandle GetLastError GetCurrentProcess GetCommandLineW GetModuleHandleW MultiByteToWideChar FindResourceW LoadResource LockResource SizeofResource GetCPInfo InterlockedCompareExchange

user32

DestroyMenu ShowWindow SetWindowTextW ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetCursor SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem GetMessageW TranslateMessage GetActiveWindow GetCursorPos ValidateRect GetWindowThreadProcessId IsWindowEnabled GetDC GetSysColorBrush RegisterWindowMessageW LoadIconW WinHelpW GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW SetPropW GetPropW RemovePropW GetFocus GetWindowTextLengthW GetWindowTextW GetForegroundWindow GetLastActivePopup DispatchMessageW GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime UnregisterDeviceNotification IsWindow PostMessageW GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetMenu EnableWindow SetForegroundWindow GetClientRect MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx GetParent LoadCursorW RegisterDeviceNotificationW IsWindowVisible EnumChildWindows GetClassNameW SendMessageW EnumWindows GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState PostQuitMessage GetWindow GetSystemMetrics GetWindowRect GetWindowPlacement CopyRect PtInRect GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu GetWindowLongW SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic ReleaseDC

gdi32

GetStockObject DeleteDC SetMapMode RestoreDC SaveDC CreateBitmap SetBkColor SetTextColor GetClipBox GetDeviceCaps ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible DeleteObject

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegDeleteKeyW RegQueryValueW RegCreateKeyExW CreateProcessAsUserW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW DeleteService CreateServiceW EnumDependentServicesW ControlService ChangeServiceConfigW QueryServiceStatusEx StartServiceW OpenServiceW OpenSCManagerW CloseServiceHandle RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegSetValueExW RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegEnumKeyW

shlwapi

PathFindExtensionW PathFindFileNameW

oleaut32

VariantClear VariantChangeType VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_e60db87f8122c1df0b5c6edb9ae5b41b_amadey_elex_floxif_remcos_rhadamanthys_stop

setupapi

userenv

kernel32

user32

gdi32

winspool.drv

advapi32

shlwapi

oleaut32

generic