2026-07-31_34374987977df6f217154242b1566a50_amadey_elex_remcos_smoke-loader

General

Target
2026-07-31_34374987977df6f217154242b1566a50_amadey_elex_remcos_smoke-loader
Size 10.3MB
Sample260731-xd41dsem6s
SHA256 6ef63158e5bd1d1c10729f312a724516ec1b743f6af62b70ccfe4222b5b812ed
MD5 34374987977df6f217154242b1566a50
SHA1 13679d23f92be09d9e0835e32828143f96b5df5a
SHA512 8be25db1daa42221de9119b3d36e56a81df1677c0d8eff7532a5c1a5c2cd30841e939ea2e5ea1ba8ad59e239ce2393d5eabbf4a0b0674804dc1b9083f61a4db9
SSDEEP 49152:yawwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwX:y
TLSH
T1BCB65C70D4B38A3EC470067CBB193B155ABFE7B0DB8925F6939008F3586B955386628F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_34374987977df6f217154242b1566a50_amadey_elex_remcos_smoke-loader

File Explorer

2026-07-31_34374987977df6f217154242b1566a50_amadey_elex_remcos_smoke-loader

.exe 10.3MB

2026-07-31_34374987977df6f217154242b1566a50_amadey_elex_remcos_smoke-loader

IMPHASH 8a60cb5b452f4bdbf9698ee60f40d39c
SHA256 6ef63158e5bd1d1c10729f312a724516ec1b743f6af62b70ccfe4222b5b812ed
MD5 34374987977df6f217154242b1566a50
SHA1 13679d23f92be09d9e0835e32828143f96b5df5a
SHA512 8be25db1daa42221de9119b3d36e56a81df1677c0d8eff7532a5c1a5c2cd30841e939ea2e5ea1ba8ad59e239ce2393d5eabbf4a0b0674804dc1b9083f61a4db9
SSDEEP 49152:yawwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwX:y
TLSH
T1BCB65C70D4B38A3EC470067CBB193B155ABFE7B0DB8925F6939008F3586B955386628F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

117392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xufagamivas42\tivokipujuwo.pdb

kernel32

TlsGetValue GetCPInfo InterlockedDecrement GetSystemWindowsDirectoryW HeapFree SetHandleInformation GetProfileSectionA SetVolumeMountPointW UnlockFile BackupSeek FreeEnvironmentStringsA GetModuleHandleW IsBadReadPtr GetConsoleAliasesLengthA ReadConsoleW CreateActCtxW GetDriveTypeA TlsSetValue ActivateActCtx GlobalAlloc GetPrivateProfileIntA GetSystemWow64DirectoryW GetVersionExW SetDllDirectoryA SetConsoleMode SetConsoleCursorPosition VerifyVersionInfoA IsDBCSLeadByte GetSystemDirectoryA CompareStringW GetStartupInfoW WritePrivateProfileStringW GetNamedPipeHandleStateW FindFirstFileExA GetLastError SetLastError GetProcAddress WriteProfileSectionA GlobalGetAtomNameA BuildCommDCBW GetPrivateProfileStringA OpenWaitableTimerA OpenWaitableTimerW SetFileApisToANSI QueryDosDeviceW SetSystemTime SetEnvironmentVariableA GetModuleFileNameA SetConsoleCursorInfo FindFirstChangeNotificationA FreeEnvironmentStringsW GetCurrentDirectoryA CompareStringA GetFileTime SetProcessShutdownParameters SetFileShortNameA ReadConsoleInputW GetWindowsDirectoryW DeleteFileW LocalFileTimeToFileTime CloseHandle SetStdHandle FlushFileBuffers LCMapStringW MoveFileA GetCommandLineW HeapSetInformation IsProcessorFeaturePresent EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime InterlockedIncrement ExitProcess GetEnvironmentStringsW HeapValidate TlsAlloc TlsFree HeapCreate WriteFile RaiseException RtlUnwind GetACP GetOEMCP IsValidCodePage SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW HeapAlloc HeapReAlloc HeapSize HeapQueryInformation GetStringTypeW MultiByteToWideChar CreateFileW

user32

GetCursorInfo GetMessagePos

winhttp

WinHttpCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_34374987977df6f217154242b1566a50_amadey_elex_remcos_smoke-loader

kernel32

user32

winhttp

generic