2026-09-29_eb275662a3589df813d86b105c8c272d_amadey_elex_redline-stealer_remcos_smoke-loader

General

Target
2026-09-29_eb275662a3589df813d86b105c8c272d_amadey_elex_redline-stealer_remcos_smoke-loader
Size 414KB
Sample260930-st4mcav16p
SHA256 271e8c086e3c66bc6da09229d984cf694e62a2a0085a6130e4ef2d81385c741f
MD5 eb275662a3589df813d86b105c8c272d
SHA1 e58beee5bce8e3676362591c027bacf300252f1c
SHA512 2a0fc6ae059dc9d5408a3321faa77af1049b2cc183b36378495ba49e80e4852bb075a952acd440171b59645caaef89aa8a8f3dc5e4cdcd55754064a6ddfe23fd
SSDEEP 12288:aKsePblmlNqQl7HZfpO99+OOjloLA1ap6W8+9D8eZ+P+b:3lmI99TOj2LOaw+9Yw
TLSH
T18B944B12E2D4B037E5A640F6C3B98A395E7C5B34230450DB93E46DFA9FA85D5393222F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_eb275662a3589df813d86b105c8c272d_amadey_elex_redline-stealer_remcos_smoke-loader

File Explorer

2026-09-29_eb275662a3589df813d86b105c8c272d_amadey_elex_redline-stealer_remcos_smoke-loader

.exe 414KB

2026-09-29_eb275662a3589df813d86b105c8c272d_amadey_elex_redline-stealer_remcos_smoke-loader

SHA256 271e8c086e3c66bc6da09229d984cf694e62a2a0085a6130e4ef2d81385c741f
MD5 eb275662a3589df813d86b105c8c272d
SHA1 e58beee5bce8e3676362591c027bacf300252f1c
SHA512 2a0fc6ae059dc9d5408a3321faa77af1049b2cc183b36378495ba49e80e4852bb075a952acd440171b59645caaef89aa8a8f3dc5e4cdcd55754064a6ddfe23fd
SSDEEP 12288:aKsePblmlNqQl7HZfpO99+OOjloLA1ap6W8+9D8eZ+P+b:3lmI99TOj2LOaw+9Yw
TLSH
T18B944B12E2D4B037E5A640F6C3B98A395E7C5B34230450DB93E46DFA9FA85D5393222F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

864512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Project\Blossom\時計仕掛けのレイライン-黄昏時の境界線-\program\Release\LeyLine.pdb

Name

.text

Size

258KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

429KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.leykr

Size

512B

Virtual Size

282B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_eb275662a3589df813d86b105c8c272d_amadey_elex_redline-stealer_remcos_smoke-loader

generic