2026-10-08_445f85db4b859994658886116e2d837f_amadey_elex_floxif_remcos_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-08_445f85db4b859994658886116e2d837f_amadey_elex_floxif_remcos_stealc_stop
Size 352KB
Sample261009-tkxm4sca96
SHA256 2587651b34ad8a1557e69eda8e67babf91e952cd89f9abd66cb3b68d37fec50f
MD5 445f85db4b859994658886116e2d837f
SHA1 a84b9c275a19932d010dd395be2555f92107277b
SHA512 5689d5642455c75e8a8188302485c83e466bfe7829b4738a8e7e9a941a1c2383b74028df8bbf92adb46a4f562df70335d73b0893c709353a2047ed4bd99ca7ca
SSDEEP 6144:JbcV2cA6JpS7yX6hmtOgb9wx3CAmAO9/WBV+UdvrEFp7hKx0k:k2cAUpSGX6hmtOG9+3CdXWBjvrEH7rk
TLSH
T1CD74CF15F6D0C3F1C9860931744ADB36CAFA563C0BB546DBE3E01A5D9E2C3F19A3660A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-08_445f85db4b859994658886116e2d837f_amadey_elex_floxif_remcos_stealc_stop

File Explorer

2026-10-08_445f85db4b859994658886116e2d837f_amadey_elex_floxif_remcos_stealc_stop

.exe 352KB

2026-10-08_445f85db4b859994658886116e2d837f_amadey_elex_floxif_remcos_stealc_stop

IMPHASH a1fc1098472f18467dbdb174a5e15c65
SHA256 2587651b34ad8a1557e69eda8e67babf91e952cd89f9abd66cb3b68d37fec50f
MD5 445f85db4b859994658886116e2d837f
SHA1 a84b9c275a19932d010dd395be2555f92107277b
SHA512 5689d5642455c75e8a8188302485c83e466bfe7829b4738a8e7e9a941a1c2383b74028df8bbf92adb46a4f562df70335d73b0893c709353a2047ed4bd99ca7ca
SSDEEP 6144:JbcV2cA6JpS7yX6hmtOgb9wx3CAmAO9/WBV+UdvrEFp7hKx0k:k2cAUpSGX6hmtOG9+3CdXWBjvrEH7rk
TLSH
T1CD74CF15F6D0C3F1C9860931744ADB36CAFA563C0BB546DBE3E01A5D9E2C3F19A3660A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

135014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

dinput8

DirectInput8Create

dsound

ord11

ddraw

DirectDrawCreateEx

winmm

mmioAdvance mmioSetInfo mmioGetInfo mmioSeek mmioAscend mmioRead mmioDescend mmioOpenA timeGetTime timeBeginPeriod

aceboard

?GetQueueData@CAceBoard@@QAEHPAE@Z ?CloseAcePort@CAceBoard@@QAEHXZ ?OpenAcePort@CAceBoard@@QAEHPADK@Z ?SendUserData@CAceBoard@@QAEXPAEH@Z ??0CAceBoard@@QAE@XZ ?GetQueueDataSize@CAceBoard@@QAEHXZ

kernel32

GetModuleHandleA CloseHandle ClearCommError GetOverlappedResult GetLastError WriteFile ReadFile CreateFileA SetFilePointer MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringA SetLocalTime GetLocalTime GetCurrentProcess GetTickCount WriteConsoleA GetProcessHeap SetEndOfFile LCMapStringW LCMapStringA GetTimeZoneInformation FlushFileBuffers IsValidCodePage GetOEMCP GetACP GetCPInfo LoadLibraryA InitializeCriticalSectionAndSpinCount GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP HeapSize SetHandleCount GetConsoleOutputCP WriteConsoleW GetLocaleInfoA GetStringTypeA GetStringTypeW SetStdHandle CompareStringA HeapAlloc HeapFree CompareStringW FileTimeToSystemTime FileTimeToLocalFileTime RaiseException RtlUnwind SetEnvironmentVariableA GetFileInformationByHandle PeekNamedPipe GetFileType GetSystemTimeAsFileTime GetCommandLineA GetStartupInfoA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetModuleHandleW Sleep GetProcAddress ExitProcess GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement

user32

ShowCursor LoadIconA LoadCursorA RegisterClassExA ExitWindowsEx DefWindowProcA GetMessageA TranslateMessage PeekMessageA DispatchMessageA LoadStringA CreateWindowExA ShowWindow UpdateWindow SetRect PostMessageA GetAsyncKeyState ChangeDisplaySettingsA PostQuitMessage MessageBoxA SystemParametersInfoA

gdi32

CreateFontA DeleteObject

advapi32

LookupPrivilegeValueA OpenProcessToken AdjustTokenPrivileges

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_445f85db4b859994658886116e2d837f_amadey_elex_floxif_remcos_stealc_stop

dinput8

dsound

ddraw

winmm

aceboard

kernel32

user32

gdi32

advapi32

iphlpapi

generic