2026-10-22_87d3fb0097bfd1c49e2cef85804413f8_elex_remcos_rhadamanthys_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_87d3fb0097bfd1c49e2cef85804413f8_elex_remcos_rhadamanthys_stealc_stop
Size 1.2MB
Sample261024-glv5fssxds
SHA256 8dbbc30c41e887762bea9b9c5ccd7381ee82d94114fe0955e01e318559835d2e
MD5 87d3fb0097bfd1c49e2cef85804413f8
SHA1 00a89fa140e91db8b9315f13e59f33e0c8d5c164
SHA512 3dbc053fe880c5e1e7a92889ba326a443c0828b0c2ad19427651c8047f48bca43b00a170ad05d44b51de8a3802a97eb71503b910514b18f971908b2942cb02ae
SSDEEP 24576:kTO7qCttjjURqenUNB4vF4udpkjEDj2j:coxtpjUEzNeF1y
TLSH
T19D4502C367A282B3F6951637C8566B31AAB6AA737B3347C363905B399C303C61D31719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_87d3fb0097bfd1c49e2cef85804413f8_elex_remcos_rhadamanthys_stealc_stop

File Explorer

2026-10-22_87d3fb0097bfd1c49e2cef85804413f8_elex_remcos_rhadamanthys_stealc_stop

.exe 1.2MB

2026-10-22_87d3fb0097bfd1c49e2cef85804413f8_elex_remcos_rhadamanthys_stealc_stop

IMPHASH a5aefb419b4225349afed1071e1a3534
SHA256 8dbbc30c41e887762bea9b9c5ccd7381ee82d94114fe0955e01e318559835d2e
MD5 87d3fb0097bfd1c49e2cef85804413f8
SHA1 00a89fa140e91db8b9315f13e59f33e0c8d5c164
SHA512 3dbc053fe880c5e1e7a92889ba326a443c0828b0c2ad19427651c8047f48bca43b00a170ad05d44b51de8a3802a97eb71503b910514b18f971908b2942cb02ae
SSDEEP 24576:kTO7qCttjjURqenUNB4vF4udpkjEDj2j:coxtpjUEzNeF1y
TLSH
T19D4502C367A282B3F6951637C8566B31AAB6AA737B3347C363905B399C303C61D31719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

153490

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\545725\out\Release\360ExtLoader.pdb

kernel32

EnterCriticalSection LoadLibraryW OutputDebugStringW GetStdHandle WriteFile GetPrivateProfileIntW WritePrivateProfileStringW GetCommandLineW SizeofResource LockResource LoadResource FindResourceW FindResourceExW LoadLibraryExW GetModuleHandleW CreateFileW DeviceIoControl GetCurrentProcessId GetLocalTime GetFileSizeEx CreateFileMappingW MapViewOfFile UnmapViewOfFile GetSystemTime SystemTimeToFileTime SetFileTime GetFileAttributesExW SetFilePointerEx SetFilePointer GetTickCount DeleteFileW SetEndOfFile GetFileAttributesW SetFileAttributesW MoveFileExW CreateThread Sleep WaitForSingleObject SetEvent ResetEvent CreateDirectoryW FindFirstFileW FindNextFileW GetProcAddress GetCurrentThread GetThreadContext VirtualQuery GetCurrentProcess SetThreadPriority FlushInstructionCache LeaveCriticalSection OpenThread GetSystemInfo GetThreadPriority VirtualProtect GetCurrentThreadId SuspendThread ResumeThread GetSystemDirectoryW WideCharToMultiByte ReadFile GetModuleFileNameW SetStdHandle GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount LoadLibraryA GetLocaleInfoA GetStringTypeW GetStringTypeA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CreateEventW VirtualFree FindClose FreeLibrary GetLastError CreateMutexW DeleteCriticalSection CloseHandle HeapCreate FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoA SetHandleCount LCMapStringW MultiByteToWideChar LCMapStringA GetModuleFileNameA ExitProcess IsValidCodePage GetOEMCP GetACP InterlockedDecrement InitializeCriticalSection VirtualAlloc RaiseException HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap CreateFileA GetSystemTimeAsFileTime LocalFileTimeToFileTime SetLastError TlsGetValue TlsSetValue HeapUnlock HeapLock HeapWalk ReleaseMutex TlsAlloc TlsFree TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent WriteConsoleW GetFileType GetStartupInfoW RtlUnwind GetCPInfo InterlockedIncrement

user32

FindWindowW EndPaint IsWindow PostThreadMessageW DefWindowProcW DestroyWindow PeekMessageW DrawTextW GetClientRect BeginPaint PostQuitMessage ShowWindow UpdateWindow CreateWindowExW RegisterClassExW LoadCursorW LoadIconW DispatchMessageW TranslateMessage GetMessageW SetTimer SendMessageW InvalidateRect KillTimer

gdi32

GetStockObject

advapi32

RegQueryValueExA RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumKeyExW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW

shlwapi

PathCombineW StrStrIW StrStrIA PathAppendW PathFileExistsW PathRemoveExtensionW PathFindExtensionW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_87d3fb0097bfd1c49e2cef85804413f8_elex_remcos_rhadamanthys_stealc_stop

kernel32

user32

gdi32

advapi32

shell32

shlwapi

generic