2026-11-01_b285e9f9ab752064c82704fc88f228e5_amadey_elex_mafia_remcos_stonedrill

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_b285e9f9ab752064c82704fc88f228e5_amadey_elex_mafia_remcos_stonedrill
Size 387KB
Sample261102-nf8a6ahs2v
SHA256 c59d69fabafa234ea5aa1ca90ba6e4631d4c891a2760e31b97a1009f86768b8e
MD5 b285e9f9ab752064c82704fc88f228e5
SHA1 fdfb79c749daf8c18abeefa889774177ae188476
SHA512 dcc5432de379a0c87c7cb6279fd56174258516268b47025da967e1b5839e70adc3b7e0c72505229d37d93ace4f037a236029c51132b61de5df6fc2208b7fc3f1
SSDEEP 12288:BqYXje0DF9k64/QSywqP0T8oIN1AHDFhY25fC2WF9sD204P:BqYDF9k64/Q9j28okAHDHY25fC2WF9ss
TLSH
T149848C22B680C072D49325719AA9DB75497EB830232169CFFBD90A7E5F647D19AF030F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_b285e9f9ab752064c82704fc88f228e5_amadey_elex_mafia_remcos_stonedrill

File Explorer

2026-11-01_b285e9f9ab752064c82704fc88f228e5_amadey_elex_mafia_remcos_stonedrill

.exe 387KB

2026-11-01_b285e9f9ab752064c82704fc88f228e5_amadey_elex_mafia_remcos_stonedrill

IMPHASH e598f7d62f78837365f795794c131eb7
SHA256 c59d69fabafa234ea5aa1ca90ba6e4631d4c891a2760e31b97a1009f86768b8e
MD5 b285e9f9ab752064c82704fc88f228e5
SHA1 fdfb79c749daf8c18abeefa889774177ae188476
SHA512 dcc5432de379a0c87c7cb6279fd56174258516268b47025da967e1b5839e70adc3b7e0c72505229d37d93ace4f037a236029c51132b61de5df6fc2208b7fc3f1
SSDEEP 12288:BqYXje0DF9k64/QSywqP0T8oIN1AHDFhY25fC2WF9sD204P:BqYDF9k64/Q9j28okAHDHY25fC2WF9ss
TLSH
T149848C22B680C072D49325719AA9DB75497EB830232169CFFBD90A7E5F647D19AF030F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

132778

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\xman_1365_x\Desktop\homeWork\13930308\Bot_70_FIX HEADER_FIX_LONGURL 73_StableAndNewProtocol - login all\Release\Bot.pdb

ws2_32

inet_ntoa WSAStartup inet_addr htons send setsockopt WSACleanup recv socket closesocket gethostbyname connect

kernel32

CreateFileA GetFileSize SetPriorityClass SetFilePointer SetErrorMode FreeLibrary GetCurrentProcess WaitForSingleObject GetModuleHandleW GetTickCount VirtualFree GetWindowsDirectoryA WriteFile GetCommandLineA LoadLibraryW TerminateThread Sleep CreateSemaphoreA CreateProcessA TerminateProcess ReadFile ExitThread ReleaseSemaphore GetLastError GetProcAddress LoadLibraryA GetExitCodeThread GetModuleHandleA VirtualProtect CloseHandle DeleteFileW GetCurrentProcessId GetTempPathA CreateThread WideCharToMultiByte FormatMessageW ExitProcess LocalAlloc LocalSize GetPriorityClass OpenProcess Process32FirstW Process32NextW CreateToolhelp32Snapshot MultiByteToWideChar SetProcessPriorityBoost CopyFileW GetModuleFileNameW GetTempPathW QueueUserAPC CopyFileA VirtualAllocEx GetModuleFileNameA lstrcatW WriteProcessMemory ResumeThread GlobalLock GlobalAlloc GlobalUnlock GlobalFree DeleteFileA GetUserDefaultLCID GetStringTypeW QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetLocaleInfoW InterlockedExchange SetConsoleCtrlHandler GetTimeZoneInformation RtlUnwind GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc SetStdHandle WriteConsoleW InitializeCriticalSection CompareStringW SetEnvironmentVariableA CreateFileW SetEndOfFile GetProcessHeap InterlockedCompareExchange lstrlenW LCMapStringW FlushFileBuffers GetConsoleMode GetConsoleCP FatalAppExitA HeapDestroy HeapCreate DeleteCriticalSection GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount RaiseException HeapSize GetCurrentThread GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage EncodePointer DecodePointer HeapFree EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime HeapAlloc HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP

user32

GetDC ReleaseDC CopyIcon GetDesktopWindow MessageBoxW SetSystemCursor GetClientRect LoadCursorW GetSystemMetrics

gdi32

BitBlt StretchBlt DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap GetObjectW SetStretchBltMode GetDIBits

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken

shell32

ShellExecuteA SHGetSpecialFolderPathA

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysAllocStringLen SysFreeString VariantInit

gdiplus

GdipGetImageEncodersSize GdiplusStartup GdipCloneImage GdipSaveImageToFile GdiplusShutdown GdipFree GdipAlloc GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncoders

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_b285e9f9ab752064c82704fc88f228e5_amadey_elex_mafia_remcos_stonedrill

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

generic