2026-08-01_bc51e2a23ce9fd376e4415d65d1ccba0_amadey_elex_manuscrypt_remcos_smoke-loader

General

Target
2026-08-01_bc51e2a23ce9fd376e4415d65d1ccba0_amadey_elex_manuscrypt_remcos_smoke-loader
Size 290KB
Sample260801-c72rxacd87
SHA256 739dd762a9970192aa662fa8d98c19faf42832d02de69550a20d641cef27b3fc
MD5 bc51e2a23ce9fd376e4415d65d1ccba0
SHA1 fc33f4da098144e83bde7416bdade1fd2c3485b0
SHA512 76d07be0ef1a0441d91994e5a6d29696cf4c5c6542c9bcae19f87268da4ffe47dec6ad47216b5aa7fcc2ec26e088d980f9162c5e5817898342e36b58911346c0
SSDEEP 3072:1G/YzdGbdoZlmledNPvl2mAg0Fuj7SahQ68i1bu2rC2Hn4MU2VYuwM7zY:gGGDyHAOfvUgBF4kYjM
TLSH
T178547DD1B1F2D971D2B24A3E1827D591093AFDA5092089BB368873EF0EF41E05A51BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_bc51e2a23ce9fd376e4415d65d1ccba0_amadey_elex_manuscrypt_remcos_smoke-loader

File Explorer

2026-08-01_bc51e2a23ce9fd376e4415d65d1ccba0_amadey_elex_manuscrypt_remcos_smoke-loader

.exe 290KB

2026-08-01_bc51e2a23ce9fd376e4415d65d1ccba0_amadey_elex_manuscrypt_remcos_smoke-loader

IMPHASH 6471f9c5d4cb6149284098ff343e0564
SHA256 739dd762a9970192aa662fa8d98c19faf42832d02de69550a20d641cef27b3fc
MD5 bc51e2a23ce9fd376e4415d65d1ccba0
SHA1 fc33f4da098144e83bde7416bdade1fd2c3485b0
SHA512 76d07be0ef1a0441d91994e5a6d29696cf4c5c6542c9bcae19f87268da4ffe47dec6ad47216b5aa7fcc2ec26e088d980f9162c5e5817898342e36b58911346c0
SSDEEP 3072:1G/YzdGbdoZlmledNPvl2mAg0Fuj7SahQ68i1bu2rC2Hn4MU2VYuwM7zY:gGGDyHAOfvUgBF4kYjM
TLSH
T178547DD1B1F2D971D2B24A3E1827D591093AFDA5092089BB368873EF0EF41E05A51BF7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8517

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCPInfo GetModuleHandleA GetLastError lstrcpyA AddAtomA GetCurrentProcess SetFilePointerEx HeapSize GetConsoleMode GetConsoleCP GetSystemTimeAdjustment SetLastError GetProcAddress GetThreadPriorityBoost WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW LCMapStringW GetStringTypeW CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW HeapAlloc HeapReAlloc HeapFree GetModuleFileNameA GetStdHandle WriteFile GetACP GetFileType GetProcessHeap FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle CreateFileW FlushFileBuffers WriteConsoleW

user32

ReleaseDC EndPaint

gdi32

GetTextMetricsA StretchBlt

Name

.text

Size

53KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

45KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

107KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

73KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_bc51e2a23ce9fd376e4415d65d1ccba0_amadey_elex_manuscrypt_remcos_smoke-loader

kernel32

user32

gdi32

generic