2026-07-20_4adfa22b590eb4934ebde7e6922f4e97_amadey_elex_remcos_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_4adfa22b590eb4934ebde7e6922f4e97_amadey_elex_remcos_smoke-loader_stealc_stop
Size 417KB
Sample260720-wdcepsby8x
SHA256 92324e66242eee3a194a0e41040cc4b73f70cf399482b33f7022d622c07a8d5e
MD5 4adfa22b590eb4934ebde7e6922f4e97
SHA1 af2bfc325fb4c91db65659bf37eae676958e0149
SHA512 34129c286e37ba188771eb1e983631304cd1135428584419638d22a3da5f9b06376b65b7aa5606ce742d5d4dc25197b45107b433bdce9fb0e849cabd157bc123
SSDEEP 6144:JPUfQdHwCLLa43ZJtLxQAOfglX1YUe3PgPiIy1s4jbmOhVN:R3dHwCXa4dxQBg8Uef0i51WOhVN
TLSH
T1C994CF1277A0C572D6A305318E66CBA16D76F5315F21C58BB3A82F2DBF303C1A536B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_4adfa22b590eb4934ebde7e6922f4e97_amadey_elex_remcos_smoke-loader_stealc_stop

File Explorer

2026-07-20_4adfa22b590eb4934ebde7e6922f4e97_amadey_elex_remcos_smoke-loader_stealc_stop

.exe 417KB

2026-07-20_4adfa22b590eb4934ebde7e6922f4e97_amadey_elex_remcos_smoke-loader_stealc_stop

IMPHASH 274243cda5952abcc0651a0f48bc51af
SHA256 92324e66242eee3a194a0e41040cc4b73f70cf399482b33f7022d622c07a8d5e
MD5 4adfa22b590eb4934ebde7e6922f4e97
SHA1 af2bfc325fb4c91db65659bf37eae676958e0149
SHA512 34129c286e37ba188771eb1e983631304cd1135428584419638d22a3da5f9b06376b65b7aa5606ce742d5d4dc25197b45107b433bdce9fb0e849cabd157bc123
SSDEEP 6144:JPUfQdHwCLLa43ZJtLxQAOfglX1YUe3PgPiIy1s4jbmOhVN:R3dHwCXa4dxQBg8Uef0i51WOhVN
TLSH
T1C994CF1277A0C572D6A305318E66CBA16D76F5315F21C58BB3A82F2DBF303C1A536B1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

98561

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\dev\360mmgo\360MobileMgrHelper\Release\360MobileMgrHelper.pdb

kernel32

lstrlenA GetCurrentProcess FlushInstructionCache SetLastError CreateProcessW CloseHandle GetStartupInfoW MulDiv GetVersionExW ReadFile SetFilePointer CreateFileW WaitForSingleObject OpenProcess GetCurrentProcessId GetModuleHandleA GetSystemInfo GetLocalTime WritePrivateProfileStringW GetPrivateProfileStringW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLongPathNameW Sleep DeviceIoControl FindResourceW GetStringTypeW GetStringTypeA WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle GetLocaleInfoA LCMapStringW LoadResource IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP GetTempPathW InitializeCriticalSectionAndSpinCount GetTickCount QueryPerformanceCounter HeapCreate GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle HeapReAlloc RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess ExitProcess TlsFree DeleteAtom FindAtomW TlsAlloc ReleaseMutex AddAtomW OpenThread GetAtomNameW TlsSetValue GetTempFileNameW DeleteFileW FindFirstFileW FindNextFileW FindClose InterlockedExchange GetCurrentThreadId GetCommandLineW CreateMutexW InterlockedIncrement SizeofResource GetLastError RaiseException lstrcmpiW LoadLibraryExW lstrlenW GetModuleFileNameW EnterCriticalSection LeaveCriticalSection GetProcAddress FreeLibrary WideCharToMultiByte LoadLibraryW TlsGetValue GetSystemTime LocalFree FormatMessageW OutputDebugStringW GetFileSizeEx WriteFile SetFilePointerEx SetEndOfFile LocalFileTimeToFileTime GetSystemTimeAsFileTime SystemTimeToFileTime CreateFileA VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange DeleteCriticalSection InitializeCriticalSection HeapSize GetModuleHandleW InterlockedDecrement MultiByteToWideChar LCMapStringA VirtualQuery

user32

ScreenToClient GetActiveWindow UnregisterClassA MessageBoxW CharNextW FindWindowW IsIconic ShowWindow SetForegroundWindow DispatchMessageW TranslateMessage GetMessageW PeekMessageW DefWindowProcW LoadStringW RegisterClassW GetClassInfoW DestroyWindow ReleaseDC GetDC GetWindowTextLengthW CallWindowProcW CreateDialogParamW ClientToScreen BeginPaint SetFocus LoadCursorW GetClassInfoExW RegisterClassExW SetWindowTextW PostQuitMessage GetWindow MonitorFromWindow GetMonitorInfoW GetSystemMetrics LoadImageW GetWindowThreadProcessId FindWindowExW PostMessageW EndPaint GetParent IsWindowVisible MapWindowPoints GetWindowRect CreateWindowExW IsWindow SetWindowPos GetWindowLongW SendMessageW MoveWindow GetClientRect InvalidateRect RedrawWindow GetWindowTextW IsDialogMessageW GetDlgItem EnableWindow SetWindowLongW

gdi32

SelectObject CreateCompatibleBitmap CreateCompatibleDC DeleteObject GetStockObject SetBkColor SetTextColor BitBlt DeleteDC

advapi32

RegQueryValueExW RegDeleteKeyW RegCloseKey RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegQueryValueExA

shell32

ShellExecuteW

ole32

CoTaskMemFree OleUninitialize CoCreateInstance CoTaskMemAlloc CoUninitialize OleInitialize CoTaskMemRealloc CoInitialize

oleaut32

SysFreeString SysAllocString SysStringByteLen SysAllocStringByteLen SysStringLen VariantClear VarUI4FromStr VariantInit

shlwapi

PathRemoveFileSpecW PathFindFileNameW SHGetValueW PathCombineW PathFileExistsW PathIsRelativeW PathAppendW

comctl32

InitCommonControlsEx _TrackMouseEvent

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

psapi

GetModuleFileNameExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_4adfa22b590eb4934ebde7e6922f4e97_amadey_elex_remcos_smoke-loader_stealc_stop

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

psapi

generic