2026-09-19_84c85b63b57f22898c42dd7503adfcfb_amadey_elex_mafia_remcos_stonedrill

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-19_84c85b63b57f22898c42dd7503adfcfb_amadey_elex_mafia_remcos_stonedrill
Size 387KB
Sample260919-hd6rnahn51
SHA256 cdc158ce6ee8161cb5573058622a1e800e4e4d918368d1015580585ee5e913f9
MD5 84c85b63b57f22898c42dd7503adfcfb
SHA1 4ce9bcb7aca77b37432188d0ef13cbea3000ba8a
SHA512 c821498d608d3c88c333c65169142f4589026e0ce314b871be91ed77d8ec0f3677a5ec96304efb476bb543fb18f6f09de4d98bb0abbf1180073247a749087e46
SSDEEP 12288:BqYXje0DF9k64/QSywqP0T8oIN1AHDFhY25fC2WF9sS204P:BqYDF9k64/Q9j28okAHDHY25fC2WF9sL
TLSH
T146848C22B680C072D49325719AA9DB75497EB830232169CFFBD90A7E5F647D19AF030F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-19_84c85b63b57f22898c42dd7503adfcfb_amadey_elex_mafia_remcos_stonedrill

File Explorer

2026-09-19_84c85b63b57f22898c42dd7503adfcfb_amadey_elex_mafia_remcos_stonedrill

.exe 387KB

2026-09-19_84c85b63b57f22898c42dd7503adfcfb_amadey_elex_mafia_remcos_stonedrill

IMPHASH e598f7d62f78837365f795794c131eb7
SHA256 cdc158ce6ee8161cb5573058622a1e800e4e4d918368d1015580585ee5e913f9
MD5 84c85b63b57f22898c42dd7503adfcfb
SHA1 4ce9bcb7aca77b37432188d0ef13cbea3000ba8a
SHA512 c821498d608d3c88c333c65169142f4589026e0ce314b871be91ed77d8ec0f3677a5ec96304efb476bb543fb18f6f09de4d98bb0abbf1180073247a749087e46
SSDEEP 12288:BqYXje0DF9k64/QSywqP0T8oIN1AHDFhY25fC2WF9sS204P:BqYDF9k64/Q9j28okAHDHY25fC2WF9sL
TLSH
T146848C22B680C072D49325719AA9DB75497EB830232169CFFBD90A7E5F647D19AF030F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

132778

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\xman_1365_x\Desktop\homeWork\13930308\Bot_70_FIX HEADER_FIX_LONGURL 73_StableAndNewProtocol - login all\Release\Bot.pdb

ws2_32

inet_ntoa WSAStartup inet_addr htons send setsockopt WSACleanup recv socket closesocket gethostbyname connect

kernel32

CreateFileA GetFileSize SetPriorityClass SetFilePointer SetErrorMode FreeLibrary GetCurrentProcess WaitForSingleObject GetModuleHandleW GetTickCount VirtualFree GetWindowsDirectoryA WriteFile GetCommandLineA LoadLibraryW TerminateThread Sleep CreateSemaphoreA CreateProcessA TerminateProcess ReadFile ExitThread ReleaseSemaphore GetLastError GetProcAddress LoadLibraryA GetExitCodeThread GetModuleHandleA VirtualProtect CloseHandle DeleteFileW GetCurrentProcessId GetTempPathA CreateThread WideCharToMultiByte FormatMessageW ExitProcess LocalAlloc LocalSize GetPriorityClass OpenProcess Process32FirstW Process32NextW CreateToolhelp32Snapshot MultiByteToWideChar SetProcessPriorityBoost CopyFileW GetModuleFileNameW GetTempPathW QueueUserAPC CopyFileA VirtualAllocEx GetModuleFileNameA lstrcatW WriteProcessMemory ResumeThread GlobalLock GlobalAlloc GlobalUnlock GlobalFree DeleteFileA GetUserDefaultLCID GetStringTypeW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetLocaleInfoW InterlockedExchange SetConsoleCtrlHandler GetTimeZoneInformation RtlUnwind GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc SetStdHandle WriteConsoleW InitializeCriticalSection CompareStringW SetEnvironmentVariableA CreateFileW SetEndOfFile GetProcessHeap InterlockedCompareExchange lstrlenW LCMapStringW FlushFileBuffers GetConsoleMode GetConsoleCP FatalAppExitA HeapDestroy HeapCreate DeleteCriticalSection GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount RaiseException HeapSize GetCurrentThread GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage EncodePointer DecodePointer HeapFree EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime HeapAlloc HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP

user32

GetDC ReleaseDC CopyIcon GetDesktopWindow MessageBoxW SetSystemCursor GetClientRect LoadCursorW GetSystemMetrics

gdi32

BitBlt StretchBlt DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap GetObjectW SetStretchBltMode GetDIBits

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken

shell32

ShellExecuteA SHGetSpecialFolderPathA

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysAllocStringLen SysFreeString VariantInit

gdiplus

GdipGetImageEncodersSize GdiplusStartup GdipCloneImage GdipSaveImageToFile GdiplusShutdown GdipFree GdipAlloc GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncoders

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-19_84c85b63b57f22898c42dd7503adfcfb_amadey_elex_mafia_remcos_stonedrill

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

generic