2026-11-04_bde09c62a8b63d5a62f285dc98fa2ab5_amadey_elex_floxif_remcos_smoke-loader_stealc_stop

General

Target
2026-11-04_bde09c62a8b63d5a62f285dc98fa2ab5_amadey_elex_floxif_remcos_smoke-loader_stealc_stop
Size 328KB
Sample261105-rtcces1tbw
SHA256 a440e242a83d7e7a4599a17c580d7db88cfbbc600ec5b1e58abdb4dfe1374c20
MD5 bde09c62a8b63d5a62f285dc98fa2ab5
SHA1 32c1762ad3b2d71a004126d84595deb5c59c0c09
SHA512 c5a26cf56275813009d02af966ed073e45442194537a3fb2b8050f4d1f40880f2fb5e1cc5b3ec117a4e0462a12b281918e2c89a715c312df0b45229746f481d8
SSDEEP 6144:l0TM5r5pWFrOj9kew4Wac4GkzAOCbBV+UdvrEFp7hKi:l0TMDpQrE+j4sozIbBjvrEH7t
TLSH
T12B64BE047590C3F2C1670478349D8B928AF4492D562FA8977BED374EAF7C3D096E878A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-04_bde09c62a8b63d5a62f285dc98fa2ab5_amadey_elex_floxif_remcos_smoke-loader_stealc_stop

File Explorer

2026-11-04_bde09c62a8b63d5a62f285dc98fa2ab5_amadey_elex_floxif_remcos_smoke-loader_stealc_stop

.exe 328KB

2026-11-04_bde09c62a8b63d5a62f285dc98fa2ab5_amadey_elex_floxif_remcos_smoke-loader_stealc_stop

IMPHASH a5e13ecda5cb29a04a20a46e5d2bbae2
SHA256 a440e242a83d7e7a4599a17c580d7db88cfbbc600ec5b1e58abdb4dfe1374c20
MD5 bde09c62a8b63d5a62f285dc98fa2ab5
SHA1 32c1762ad3b2d71a004126d84595deb5c59c0c09
SHA512 c5a26cf56275813009d02af966ed073e45442194537a3fb2b8050f4d1f40880f2fb5e1cc5b3ec117a4e0462a12b281918e2c89a715c312df0b45229746f481d8
SSDEEP 6144:l0TM5r5pWFrOj9kew4Wac4GkzAOCbBV+UdvrEFp7hKi:l0TMDpQrE+j4sozIbBjvrEH7t
TLSH
T12B64BE047590C3F2C1670478349D8B928AF4492D562FA8977BED374EAF7C3D096E878A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

85960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

waveInPrepareHeader waveInAddBuffer waveInUnprepareHeader

kernel32

GetConsoleMode GetNumberOfConsoleInputEvents PeekConsoleInputA SetConsoleMode ReadConsoleInputA GetProcessHeap SetEndOfFile GetACP GetOEMCP Sleep SetConsoleTitleA GetShortPathNameA SetConsoleTextAttribute WriteFile GetStdHandle GetConsoleScreenBufferInfo SetEnvironmentVariableA CompareStringW CompareStringA EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc HeapReAlloc GetModuleHandleW GetProcAddress ExitProcess DeleteFileA GetSystemTimeAsFileTime CloseHandle CreateProcessA DuplicateHandle GetCurrentProcess GetCommandLineA SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree VirtualAlloc GetModuleFileNameA RtlUnwind MultiByteToWideChar ReadFile WideCharToMultiByte GetConsoleCP RaiseException SetFilePointer TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement LoadLibraryA InitializeCriticalSectionAndSpinCount FlushFileBuffers SetStdHandle GetCPInfo IsValidCodePage GetFileAttributesA CreatePipe FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetModuleHandleA

user32

SendMessageA FindWindowA

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-04_bde09c62a8b63d5a62f285dc98fa2ab5_amadey_elex_floxif_remcos_smoke-loader_stealc_stop

winmm

kernel32

user32

generic