2026-07-28_46db14eac1c2038b3b26766253ab398a_amadey_elex_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_46db14eac1c2038b3b26766253ab398a_amadey_elex_remcos_smoke-loader
Size 4.6MB
Sample260729-bqq4eatset
SHA256 5923711ceb52f2f45555509d69d7644aade1a1ea7bc0ba33665d550c704dae6b
MD5 46db14eac1c2038b3b26766253ab398a
SHA1 38f26d39dae601d930337db2852979e9b23a56c0
SHA512 7def448583b5cd0d7f68f0528553e89782d6dcd3a64dfc4a33a911b6ce4128774ef731b3e514da530e078779f02a83d59b84eb0e89945b1554f190f4c33bbf90
SSDEEP 98304:ScokMqP4j8t24UyRB+OALDS9snoJ1CsvKshwj:skYo+ltsn2j
TLSH
T15B26CF01F2A341B1C8462674549F7B7AA67CDF49433E8BC3A7E4FD191E31690A52A38F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_46db14eac1c2038b3b26766253ab398a_amadey_elex_remcos_smoke-loader

File Explorer

2026-07-28_46db14eac1c2038b3b26766253ab398a_amadey_elex_remcos_smoke-loader

.exe 4.6MB

2026-07-28_46db14eac1c2038b3b26766253ab398a_amadey_elex_remcos_smoke-loader

IMPHASH 39d70623cd89378e2fa303ee76e5da72
SHA256 5923711ceb52f2f45555509d69d7644aade1a1ea7bc0ba33665d550c704dae6b
MD5 46db14eac1c2038b3b26766253ab398a
SHA1 38f26d39dae601d930337db2852979e9b23a56c0
SHA512 7def448583b5cd0d7f68f0528553e89782d6dcd3a64dfc4a33a911b6ce4128774ef731b3e514da530e078779f02a83d59b84eb0e89945b1554f190f4c33bbf90
SSDEEP 98304:ScokMqP4j8t24UyRB+OALDS9snoJ1CsvKshwj:skYo+ltsn2j
TLSH
T15B26CF01F2A341B1C8462674549F7B7AA67CDF49433E8BC3A7E4FD191E31690A52A38F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3520721

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

d3d9

Direct3DCreate9

dinput8

DirectInput8Create

user32

PeekMessageA GetCursorPos wvsprintfA MessageBoxA GetSystemMetrics DefWindowProcA GetMessageA DispatchMessageA ShowCursor TranslateMessage LoadIconA LoadCursorA RegisterClassExA AdjustWindowRect GetDesktopWindow CreateWindowExA UpdateWindow SetCursor SetFocus SetForegroundWindow ShowWindow SetWindowLongA DestroyWindow BeginPaint EndPaint PostMessageA IsIconic ReleaseCapture SetCapture GetClientRect GetWindowRect SetRect UnregisterClassA SetActiveWindow GetForegroundWindow wsprintfA PostThreadMessageA PostQuitMessage

advapi32

RegSetValueExA RegQueryValueExA RegOpenKeyExA RegOpenKeyA RegCreateKeyA RegCloseKey

gdi32

SetTextColor CreateCompatibleDC CreateFontA CreateBitmap SetBkMode DeleteDC ExtTextOutA SetBkColor GetPixel DeleteObject SelectObject BitBlt

shfolder

SHGetFolderPathA

shell32

ShellExecuteA

ws2_32

WSAGetLastError WSAStartup setsockopt ioctlsocket socket closesocket shutdown connect listen accept sendto send recvfrom recv select getpeername getsockname gethostbyname WSAIoctl WSACleanup bind

kernel32

VirtualQuery IsBadCodePtr GetCurrentProcessId SetEndOfFile SetStdHandle FlushFileBuffers GetStringTypeW GetStringTypeA IsValidCodePage IsValidLocale EnumSystemLocalesA CompareStringA CompareStringW SetEnvironmentVariableA IsDebuggerPresent DebugBreak GetLocaleInfoW GetTickCount GetLocaleInfoA GetUserDefaultLCID LCMapStringW LCMapStringA SetUnhandledExceptionFilter GetCPInfo GetOEMCP GetACP HeapSize HeapReAlloc HeapCreate HeapDestroy TlsAlloc SetLastError TlsFree GetStartupInfoA SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter IsBadWritePtr IsBadReadPtr GetLastError QueryPerformanceFrequency QueryPerformanceCounter FindClose FindNextFileA FindFirstFileA CreateDirectoryA MultiByteToWideChar GetModuleFileNameA GetModuleHandleA GetLongPathNameA SetErrorMode CloseHandle Process32Next Process32First Sleep CreateToolhelp32Snapshot SuspendThread ResumeThread GetDriveTypeA GetLogicalDrives GetVersionExA OutputDebugStringA SetProcessAffinityMask SetThreadPriority SetPriorityClass GetProcessAffinityMask GetThreadPriority GetPriorityClass GetCurrentThread GetCurrentProcess FreeLibrary GetProcAddress LoadLibraryA WideCharToMultiByte GetSystemInfo IsProcessorFeaturePresent EnterCriticalSection InterlockedExchange InitializeCriticalSection InterlockedCompareExchange DeleteCriticalSection LeaveCriticalSection GetFullPathNameA MapViewOfFile GetFileSize CreateFileMappingA CreateFileA CreateFileW UnmapViewOfFile LockResource LoadResource SizeofResource FindResourceA FindResourceW VirtualFree VirtualAlloc lstrcmpiA DuplicateHandle GetCurrentThreadId TerminateThread SleepEx GetExitCodeThread CreateEventA SetEvent WaitForSingleObject ResetEvent GetCurrentDirectoryA WriteFile SetFilePointer DeleteFileA MoveFileA ReadFile GetDiskFreeSpaceExA GlobalAlloc GlobalFree VirtualProtect CreateThread CreateMutexA ReleaseMutex HeapFree GetProcessHeap HeapAlloc WaitCommEvent GetOverlappedResult SetCommMask WaitForMultipleObjects PurgeComm SetCommState GetCommState SetCommConfig GetCommConfig SetCommTimeouts SetupComm GetCommandLineA RtlUnwind ExitProcess TerminateProcess GetTimeZoneInformation GetSystemTimeAsFileTime RaiseException ExitThread TlsSetValue TlsGetValue FileTimeToSystemTime FileTimeToLocalFileTime GetDiskFreeSpaceA GetFileType RemoveDirectoryA GetStdHandle

dsound

ord1

ddraw

DirectDrawCreate

winmm

timeSetEvent timeKillEvent timeBeginPeriod timeGetDevCaps timeGetTime timeEndPeriod

tapi32

lineAnswer lineMakeCall lineGetID lineClose lineNegotiateAPIVersion lineOpen lineGetDevCaps lineInitialize lineShutdown

netapi32

Netbios

generic

count=3, id=39, version=9162,

count=51, id=64, productName=VS2002 (.NET) build 9466, version=9466,

count=178, id=28, productName=VS2002 (.NET) build 9466, version=9466,

count=87, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=12, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=251, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=5, id=28, version=9178,

count=28, id=25, version=9210,

count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=12, id=95, version=2067,

count=6, id=18, version=8444,

count=121, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=263, id=1, productName=Unmarked objects,

count=107, id=29, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=61, productName=VS2002 (.NET) build 9466, version=9466,