2026-10-23_54c9ccc64e86aedd8f2b6927fa3a62e1_amadey_elex_mafia_remcos_stonedrill

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_54c9ccc64e86aedd8f2b6927fa3a62e1_amadey_elex_mafia_remcos_stonedrill
Size 387KB
Sample261023-pdxbjsbw4s
SHA256 72cee8681acdb074d28b458f67f39143b57e201c4adc66ed7810b210432addac
MD5 54c9ccc64e86aedd8f2b6927fa3a62e1
SHA1 b99f1411a38f35dc4a3ce478cb42ca4d08b35ef1
SHA512 a2b7d5797823a7f53e4dd2ac6be198819fe920ff6cc8a510fc7c89efc5ec71f7a1e8b51ab951165959819f27d4602f22b16399b740d2976558a25f57a764ba12
SSDEEP 12288:WqYXje0DF9k64/QSywqP0T8oIN1AHDFhY25fC2WF9sY204P:WqYDF9k64/Q9j28okAHDHY25fC2WF9sp
TLSH
T1BE848C22B680C032D49325719AA9DB75497AB830232169CFFBD91A7E5F647D19AF030F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_54c9ccc64e86aedd8f2b6927fa3a62e1_amadey_elex_mafia_remcos_stonedrill

File Explorer

2026-10-23_54c9ccc64e86aedd8f2b6927fa3a62e1_amadey_elex_mafia_remcos_stonedrill

.exe 387KB

2026-10-23_54c9ccc64e86aedd8f2b6927fa3a62e1_amadey_elex_mafia_remcos_stonedrill

IMPHASH e598f7d62f78837365f795794c131eb7
SHA256 72cee8681acdb074d28b458f67f39143b57e201c4adc66ed7810b210432addac
MD5 54c9ccc64e86aedd8f2b6927fa3a62e1
SHA1 b99f1411a38f35dc4a3ce478cb42ca4d08b35ef1
SHA512 a2b7d5797823a7f53e4dd2ac6be198819fe920ff6cc8a510fc7c89efc5ec71f7a1e8b51ab951165959819f27d4602f22b16399b740d2976558a25f57a764ba12
SSDEEP 12288:WqYXje0DF9k64/QSywqP0T8oIN1AHDFhY25fC2WF9sY204P:WqYDF9k64/Q9j28okAHDHY25fC2WF9sp
TLSH
T1BE848C22B680C032D49325719AA9DB75497AB830232169CFFBD91A7E5F647D19AF030F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

132778

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\xman_1365_x\Desktop\homeWork\13930308\Bot_70_FIX HEADER_FIX_LONGURL 73_StableAndNewProtocol - login all\Release\Bot.pdb

ws2_32

inet_ntoa WSAStartup inet_addr htons send setsockopt WSACleanup recv socket closesocket gethostbyname connect

kernel32

CreateFileA GetFileSize SetPriorityClass SetFilePointer SetErrorMode FreeLibrary GetCurrentProcess WaitForSingleObject GetModuleHandleW GetTickCount VirtualFree GetWindowsDirectoryA WriteFile GetCommandLineA LoadLibraryW TerminateThread Sleep CreateSemaphoreA CreateProcessA TerminateProcess ReadFile ExitThread ReleaseSemaphore GetLastError GetProcAddress LoadLibraryA GetExitCodeThread GetModuleHandleA VirtualProtect CloseHandle DeleteFileW GetCurrentProcessId GetTempPathA CreateThread WideCharToMultiByte FormatMessageW ExitProcess LocalAlloc LocalSize GetPriorityClass OpenProcess Process32FirstW Process32NextW CreateToolhelp32Snapshot MultiByteToWideChar SetProcessPriorityBoost CopyFileW GetModuleFileNameW GetTempPathW QueueUserAPC CopyFileA VirtualAllocEx GetModuleFileNameA lstrcatW WriteProcessMemory ResumeThread GlobalLock GlobalAlloc GlobalUnlock GlobalFree DeleteFileA GetUserDefaultLCID GetStringTypeW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetLocaleInfoW InterlockedExchange SetConsoleCtrlHandler GetTimeZoneInformation RtlUnwind GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc SetStdHandle WriteConsoleW InitializeCriticalSection CompareStringW SetEnvironmentVariableA CreateFileW SetEndOfFile GetProcessHeap InterlockedCompareExchange lstrlenW LCMapStringW FlushFileBuffers GetConsoleMode GetConsoleCP FatalAppExitA HeapDestroy HeapCreate DeleteCriticalSection GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount RaiseException HeapSize GetCurrentThread GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage EncodePointer DecodePointer HeapFree EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime HeapAlloc HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP

user32

GetDC ReleaseDC CopyIcon GetDesktopWindow MessageBoxW SetSystemCursor GetClientRect LoadCursorW GetSystemMetrics

gdi32

BitBlt StretchBlt DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap GetObjectW SetStretchBltMode GetDIBits

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken

shell32

ShellExecuteA SHGetSpecialFolderPathA

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysAllocStringLen SysFreeString VariantInit

gdiplus

GdipGetImageEncodersSize GdiplusStartup GdipCloneImage GdipSaveImageToFile GdiplusShutdown GdipFree GdipAlloc GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncoders

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_54c9ccc64e86aedd8f2b6927fa3a62e1_amadey_elex_mafia_remcos_stonedrill

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

generic