2026-07-18_a6951ce588229561eb53b36f8495ad33_amadey_elex_remcos_smoke-loader

General

Target
2026-07-18_a6951ce588229561eb53b36f8495ad33_amadey_elex_remcos_smoke-loader
Size 1.4MB
Sample260718-hkelraex2x
SHA256 ede2166f5bee46544feafa204377d28668cc25383e0b68970c901f107db23323
MD5 a6951ce588229561eb53b36f8495ad33
SHA1 05ef15211def7ec7417cc23939933cb5901e53f0
SHA512 cc39e0a75bec5b29f5a3d964a6a5fcb3c5a243c7b2aa668f79926ae9bca0ba6eb11102f44fb974525163f41b75067b6a3882fbae08d062ce9ab52797fa800f3c
SSDEEP 24576:MnHp/Hhf9QVH+EozhX4fXwAwErgBiTyu4g1iyuCifciNsKKGvGlKfxThgxdyUYN2:MHp5f9QVH+EoztytwErgATvButcKHGY0
TLSH
T1C865235A22A3C433D0D60A330EADCBD0297A783A0B3E59D7B6945F1D7D262C0E679717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_a6951ce588229561eb53b36f8495ad33_amadey_elex_remcos_smoke-loader

File Explorer

2026-07-18_a6951ce588229561eb53b36f8495ad33_amadey_elex_remcos_smoke-loader

.exe 1.4MB

2026-07-18_a6951ce588229561eb53b36f8495ad33_amadey_elex_remcos_smoke-loader

IMPHASH 02b3ce340cb3d5f749106f2a690d1833
SHA256 ede2166f5bee46544feafa204377d28668cc25383e0b68970c901f107db23323
MD5 a6951ce588229561eb53b36f8495ad33
SHA1 05ef15211def7ec7417cc23939933cb5901e53f0
SHA512 cc39e0a75bec5b29f5a3d964a6a5fcb3c5a243c7b2aa668f79926ae9bca0ba6eb11102f44fb974525163f41b75067b6a3882fbae08d062ce9ab52797fa800f3c
SSDEEP 24576:MnHp/Hhf9QVH+EozhX4fXwAwErgBiTyu4g1iyuCifciNsKKGvGlKfxThgxdyUYN2:MHp5f9QVH+EoztytwErgATvButcKHGY0
TLSH
T1C865235A22A3C433D0D60A330EADCBD0297A783A0B3E59D7B6945F1D7D262C0E679717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

171713

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetProcAddress LoadLibraryW SystemTimeToFileTime SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetModuleHandleA GetCurrentProcess LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetLastError CloseHandle LoadLibraryA WideCharToMultiByte MoveFileW DeleteFileW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW lstrlenW CreateFileW GetFileSize ReadFile WriteFile Sleep GetComputerNameA GetModuleFileNameW CreateProcessW GetSystemTime RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalAlloc SetEndOfFile SetStdHandle WriteConsoleW GetStringTypeW InterlockedExchange GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentThreadId EncodePointer DecodePointer SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent RtlUnwind GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW MultiByteToWideChar FreeLibrary

ole32

CoCreateInstance CoInitialize

shell32

SHGetSpecialFolderPathW ShellExecuteW

shlwapi

PathAddExtensionW PathAppendW PathFileExistsW PathIsRootW PathRemoveExtensionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_a6951ce588229561eb53b36f8495ad33_amadey_elex_remcos_smoke-loader

kernel32

ole32

shell32

shlwapi

generic