2026-10-08_5ce0649e789894b132920c78aeac52a2_amadey_elex_mafia_remcos_stonedrill

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-08_5ce0649e789894b132920c78aeac52a2_amadey_elex_mafia_remcos_stonedrill
Size 387KB
Sample261009-q5wprsys6r
SHA256 93a4b2284c76f2dc946051bb0d49d1a5176a1b4ad7656c15c3783b065bae26a2
MD5 5ce0649e789894b132920c78aeac52a2
SHA1 af04e986e1ac20f52874eb0331f2f9156a1693f0
SHA512 61579dfa45b215b73f628d44370a25a4e5088a7d83709847c0a10f7f7cb311d45f1b542795eb2835e45cd02bd5e638af3d359f17bbcf5a711f0a9e682a0fb509
SSDEEP 12288:BqYXje0DF9k64/QSywqP0T8oIN1AHDFhY25fC2WF9jR204:BqYDF9k64/Q9j28okAHDHY25fC2WF9j4
TLSH
T1EA848C22B680C072D49325719AA9DB75497AB430233169CFFBD90ABE5F647D19AF030F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-08_5ce0649e789894b132920c78aeac52a2_amadey_elex_mafia_remcos_stonedrill

File Explorer

2026-10-08_5ce0649e789894b132920c78aeac52a2_amadey_elex_mafia_remcos_stonedrill

.exe 387KB

2026-10-08_5ce0649e789894b132920c78aeac52a2_amadey_elex_mafia_remcos_stonedrill

IMPHASH e598f7d62f78837365f795794c131eb7
SHA256 93a4b2284c76f2dc946051bb0d49d1a5176a1b4ad7656c15c3783b065bae26a2
MD5 5ce0649e789894b132920c78aeac52a2
SHA1 af04e986e1ac20f52874eb0331f2f9156a1693f0
SHA512 61579dfa45b215b73f628d44370a25a4e5088a7d83709847c0a10f7f7cb311d45f1b542795eb2835e45cd02bd5e638af3d359f17bbcf5a711f0a9e682a0fb509
SSDEEP 12288:BqYXje0DF9k64/QSywqP0T8oIN1AHDFhY25fC2WF9jR204:BqYDF9k64/Q9j28okAHDHY25fC2WF9j4
TLSH
T1EA848C22B680C072D49325719AA9DB75497AB430233169CFFBD90ABE5F647D19AF030F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

132778

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\xman_1365_x\Desktop\homeWork\13930308\Bot_70_FIX HEADER_FIX_LONGURL 73_StableAndNewProtocol - login all\Release\Bot.pdb

ws2_32

inet_ntoa WSAStartup inet_addr htons send setsockopt WSACleanup recv socket closesocket gethostbyname connect

kernel32

CreateFileA GetFileSize SetPriorityClass SetFilePointer SetErrorMode FreeLibrary GetCurrentProcess WaitForSingleObject GetModuleHandleW GetTickCount VirtualFree GetWindowsDirectoryA WriteFile GetCommandLineA LoadLibraryW TerminateThread Sleep CreateSemaphoreA CreateProcessA TerminateProcess ReadFile ExitThread ReleaseSemaphore GetLastError GetProcAddress LoadLibraryA GetExitCodeThread GetModuleHandleA VirtualProtect CloseHandle DeleteFileW GetCurrentProcessId GetTempPathA CreateThread WideCharToMultiByte FormatMessageW ExitProcess LocalAlloc LocalSize GetPriorityClass OpenProcess Process32FirstW Process32NextW CreateToolhelp32Snapshot MultiByteToWideChar SetProcessPriorityBoost CopyFileW GetModuleFileNameW GetTempPathW QueueUserAPC CopyFileA VirtualAllocEx GetModuleFileNameA lstrcatW WriteProcessMemory ResumeThread GlobalLock GlobalAlloc GlobalUnlock GlobalFree DeleteFileA GetUserDefaultLCID GetStringTypeW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetLocaleInfoW InterlockedExchange SetConsoleCtrlHandler GetTimeZoneInformation RtlUnwind GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc SetStdHandle WriteConsoleW InitializeCriticalSection CompareStringW SetEnvironmentVariableA CreateFileW SetEndOfFile GetProcessHeap InterlockedCompareExchange lstrlenW LCMapStringW FlushFileBuffers GetConsoleMode GetConsoleCP FatalAppExitA HeapDestroy HeapCreate DeleteCriticalSection GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount RaiseException HeapSize GetCurrentThread GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage EncodePointer DecodePointer HeapFree EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime HeapAlloc HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP

user32

GetDC ReleaseDC CopyIcon GetDesktopWindow MessageBoxW SetSystemCursor GetClientRect LoadCursorW GetSystemMetrics

gdi32

BitBlt StretchBlt DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap GetObjectW SetStretchBltMode GetDIBits

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken

shell32

ShellExecuteA SHGetSpecialFolderPathA

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysAllocStringLen SysFreeString VariantInit

gdiplus

GdipGetImageEncodersSize GdiplusStartup GdipCloneImage GdipSaveImageToFile GdiplusShutdown GdipFree GdipAlloc GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncoders

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_5ce0649e789894b132920c78aeac52a2_amadey_elex_mafia_remcos_stonedrill

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

generic