2026-11-08_4758d56cd7d7a45d7a3a52e9583a11d7_amadey_elex_floxif_remcos_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-08_4758d56cd7d7a45d7a3a52e9583a11d7_amadey_elex_floxif_remcos_stealc_stop
Size 413KB
Sample261109-e2plhawybx
SHA256 13070fa57ea7742db74c7f87848b13834592f2ecbce9697b6516a3146e9eb0cd
MD5 4758d56cd7d7a45d7a3a52e9583a11d7
SHA1 ca329fcce0479012b80b0d0b916dcfa395985f9e
SHA512 8c9540c2b247b43086229a0617fdd1002e889a952318d925909d1e4e70ad73da0be7607ca31f0915bd88abe31ac691c8c9798910b53951eda68133dd820c3570
SSDEEP 12288:VP56syVY5tB6RZuwTK9ErdHG7BjvrEH7J:C86RNdHcrEH7J
TLSH
T1E294BF14FB80D3F4C1651A34B15F9B63EAB9537C073422E7E3D01E592E683E2667A70A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-08_4758d56cd7d7a45d7a3a52e9583a11d7_amadey_elex_floxif_remcos_stealc_stop

File Explorer

2026-11-08_4758d56cd7d7a45d7a3a52e9583a11d7_amadey_elex_floxif_remcos_stealc_stop

.exe 413KB

2026-11-08_4758d56cd7d7a45d7a3a52e9583a11d7_amadey_elex_floxif_remcos_stealc_stop

IMPHASH 57d040684e3bd855a1536c9dad1a7964
SHA256 13070fa57ea7742db74c7f87848b13834592f2ecbce9697b6516a3146e9eb0cd
MD5 4758d56cd7d7a45d7a3a52e9583a11d7
SHA1 ca329fcce0479012b80b0d0b916dcfa395985f9e
SHA512 8c9540c2b247b43086229a0617fdd1002e889a952318d925909d1e4e70ad73da0be7607ca31f0915bd88abe31ac691c8c9798910b53951eda68133dd820c3570
SSDEEP 12288:VP56syVY5tB6RZuwTK9ErdHG7BjvrEH7J:C86RNdHcrEH7J
TLSH
T1E294BF14FB80D3F4C1651A34B15F9B63EAB9537C073422E7E3D01E592E683E2667A70A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

196118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

dinput8

DirectInput8Create

dsound

ord11

ddraw

DirectDrawCreateEx

winmm

timeBeginPeriod timeGetTime mmioOpenA mmioDescend mmioRead mmioAscend mmioSeek mmioGetInfo mmioAdvance mmioSetInfo

kernel32

GetModuleHandleA CloseHandle PurgeComm SetCommMask ClearCommError GetOverlappedResult GetLastError WriteFile ReadFile WaitCommEvent CreateEventA CreateThread SetCommTimeouts SetCommState GetCommState CreateFileA SetFilePointer MultiByteToWideChar WideCharToMultiByte GetTickCount LeaveCriticalSection EnterCriticalSection CreateDirectoryA InitializeCriticalSection SetLocalTime GetLocalTime SetEvent WaitForSingleObject ResetEvent GetCommMask GetCommTimeouts GetCurrentProcess Sleep DeleteFileA GetPrivateProfileStringA GetDriveTypeA SetStdHandle CompareStringA GetStringTypeW GetStringTypeA GetLocaleInfoA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetProcessHeap SetEndOfFile LCMapStringW LCMapStringA GetTimeZoneInformation FlushFileBuffers IsValidCodePage GetOEMCP GetACP GetCPInfo LoadLibraryA GetFullPathNameA InterlockedDecrement InitializeCriticalSectionAndSpinCount HeapSize GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP CompareStringW GetCurrentThreadId HeapFree HeapAlloc FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA RaiseException RtlUnwind SetEnvironmentVariableA GetCurrentDirectoryA GetSystemTimeAsFileTime GetFileInformationByHandle PeekNamedPipe GetFileType GetCommandLineA GetStartupInfoA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree DeleteCriticalSection VirtualAlloc HeapReAlloc GetModuleHandleW GetProcAddress ExitProcess GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError SetHandleCount

user32

DispatchMessageA PostQuitMessage ChangeDisplaySettingsA PostMessageA SetRect UpdateWindow ShowWindow CreateWindowExA GetAsyncKeyState LoadStringA ShowCursor PeekMessageA GetMessageA TranslateMessage MessageBoxA LoadIconA LoadCursorA RegisterClassExA DefWindowProcA ExitWindowsEx SystemParametersInfoA

gdi32

CreateFontA DeleteObject

advapi32

LookupPrivilegeValueA OpenProcessToken AdjustTokenPrivileges

ws2_32

htons

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-08_4758d56cd7d7a45d7a3a52e9583a11d7_amadey_elex_floxif_remcos_stealc_stop

dinput8

dsound

ddraw

winmm

kernel32

user32

gdi32

advapi32

ws2_32

generic