2026-07-17_01f01f79c381e1a79efd5b1568e024f5_amadey_elex_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-17_01f01f79c381e1a79efd5b1568e024f5_amadey_elex_remcos_smoke-loader
Size 8.8MB
Sample260718-ac233sdx71
SHA256 aa0cc190736a61c8a01d6c22d9d786c31db8ebe5a060a1b7f52d4989052e6bc9
MD5 01f01f79c381e1a79efd5b1568e024f5
SHA1 16b862a4390f346715c8bce8d4291ceb85b00706
SHA512 fc59da56cf2ab8de066725b7bcf313ee6f0a1d75e90841d1cb96bb144041d42e822aa2eb1ec5e43378a0e74ca8b78636333ea601ac3320f17538141963d914cf
SSDEEP 196608:VmCd8Pljn+H+nXl9jgRXbMXurKSLvzMxMZIYNQjpgvIg6HFmXceS0:068PVni+nXlZLbovAxMZajpvCzV
TLSH
T1AE963340B62AF469EAA6017048B5779930691E74331844EFFB9F3ED72E340D22E75DB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-17_01f01f79c381e1a79efd5b1568e024f5_amadey_elex_remcos_smoke-loader

File Explorer

2026-07-17_01f01f79c381e1a79efd5b1568e024f5_amadey_elex_remcos_smoke-loader

.exe 8.8MB

2026-07-17_01f01f79c381e1a79efd5b1568e024f5_amadey_elex_remcos_smoke-loader

IMPHASH 2c1d58bac8430a64caf08d3ac656cc3b
SHA256 aa0cc190736a61c8a01d6c22d9d786c31db8ebe5a060a1b7f52d4989052e6bc9
MD5 01f01f79c381e1a79efd5b1568e024f5
SHA1 16b862a4390f346715c8bce8d4291ceb85b00706
SHA512 fc59da56cf2ab8de066725b7bcf313ee6f0a1d75e90841d1cb96bb144041d42e822aa2eb1ec5e43378a0e74ca8b78636333ea601ac3320f17538141963d914cf
SSDEEP 196608:VmCd8Pljn+H+nXl9jgRXbMXurKSLvzMxMZIYNQjpgvIg6HFmXceS0:068PVni+nXlZLbovAxMZajpvCzV
TLSH
T1AE963340B62AF469EAA6017048B5779930691E74331844EFFB9F3ED72E340D22E75DB2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

CreatePropertySheetPageW CreatePropertySheetPageA

kernel32

QueryPerformanceCounter GetTickCount CreateWaitableTimerW GetLastError WideCharToMultiByte MultiByteToWideChar AreFileApisANSI LoadLibraryExW LoadLibraryW GetModuleFileNameA GetModuleFileNameW FormatMessageA FormatMessageW LocalFree GetSystemDirectoryW CreateFileW SetFileTime CloseHandle SetFileAttributesA SetFileAttributesW RemoveDirectoryA RemoveDirectoryW CreateDirectoryA CreateDirectoryW DeleteFileA DeleteFileW SetCurrentDirectoryA SetCurrentDirectoryW GetCurrentDirectoryA GetCurrentDirectoryW GetTempPathA GetTempPathW GetFileInformationByHandle GetStdHandle FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW GetModuleHandleA GetFileAttributesA GetFileAttributesW CreateFileA GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile GetCurrentProcess SetLastError GetCurrentThreadId GlobalMemoryStatus GetSystemTimeAsFileTime Sleep GetVersion IsProcessorFeaturePresent ReleaseSemaphore InitializeCriticalSection WaitForSingleObject SetEvent ResetEvent CreateSemaphoreA CreateEventA GetVersionExA GetModuleHandleW CreateProcessA SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize SetStdHandle GetFileType GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA WriteConsoleW GetOEMCP IsValidCodePage FindFirstFileExA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW HeapReAlloc GetACP ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetCurrentProcessId LeaveCriticalSection EnterCriticalSection DeleteCriticalSection IsBadReadPtr FreeLibrary GetProcAddress HeapAlloc GetNativeSystemInfo LoadLibraryA VirtualAlloc GetSystemInfo VirtualFree HeapFree GetProcessAffinityMask RaiseException RtlUnwind GetCPInfo LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW InitializeSListHead GetStartupInfoW IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter

user32

DestroyWindow LoadIconA EndDialog KillTimer SetTimer PostMessageA SendMessageA MessageBoxW SetWindowTextW SetWindowTextA LoadStringW LoadStringA DialogBoxParamW DialogBoxParamA GetDlgItem GetWindowLongA SetWindowLongA ShowWindow CharUpperA CharUpperW SetScrollInfo GetScrollRange EnableScrollBar

gdi32

GetClipRgn RemoveFontResourceExA EnumFontFamiliesExW CancelDC GetPixel CreateDIBitmap GetPath GetWinMetaFileBits SetBkMode ChoosePixelFormat DeleteColorSpace Chord GetViewportOrgEx GetTextFaceA

comdlg32

GetFileTitleA

oleaut32

VariantClear SysAllocStringLen SysStringLen VarR8FromI4 VarR4FromI2 VarR4FromUI4 SafeArrayUnaccessData VarI4FromUI1 VarBoolFromI1 VarUI2FromUI4 GetErrorInfo VarI2FromR8 VarR4FromStr VarR8FromBool VarUI4FromUI8 VarUI4FromStr

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_01f01f79c381e1a79efd5b1568e024f5_amadey_elex_remcos_smoke-loader

comctl32

kernel32

user32

gdi32

comdlg32

oleaut32

generic