2026-08-04_026b04e1822b673a3fbab94058a52125_amadey_elex_plugx_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_026b04e1822b673a3fbab94058a52125_amadey_elex_plugx_remcos_smoke-loader
Size 13.7MB
Sample260804-1a8e7a1bkh
SHA256 d4eb7aae7d9c0720fd06b7822f7f289a95aa80d5cd593b175b3c8b179f21b7c4
MD5 026b04e1822b673a3fbab94058a52125
SHA1 b79355c5ffbd775b5e5e0b626f841f20bda1fabb
SHA512 af133e78a3dcc45b39d6a4898c3d05de32b334e0365cd9cf6e7da3f5a2a49639af538cb50258653ac3afb8911876de7f0b2c5a31716d4cad22edf2cc3919292d
SSDEEP 196608:7KMfXEDFOIW6bnVSUsYBg13CuacYfNSr:7KKXEDFbW6bnVTulFa/k
TLSH
T17EE617B79B6196F6C66D3932D4A3E13F9E3940E3CF062EE3D1558919B9637D3903A080
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_026b04e1822b673a3fbab94058a52125_amadey_elex_plugx_remcos_smoke-loader

File Explorer

2026-08-04_026b04e1822b673a3fbab94058a52125_amadey_elex_plugx_remcos_smoke-loader

.exe 13.7MB

2026-08-04_026b04e1822b673a3fbab94058a52125_amadey_elex_plugx_remcos_smoke-loader

IMPHASH 5fc2adfa6f99eaa6a9321b0eda9238f5
SHA256 d4eb7aae7d9c0720fd06b7822f7f289a95aa80d5cd593b175b3c8b179f21b7c4
MD5 026b04e1822b673a3fbab94058a52125
SHA1 b79355c5ffbd775b5e5e0b626f841f20bda1fabb
SHA512 af133e78a3dcc45b39d6a4898c3d05de32b334e0365cd9cf6e7da3f5a2a49639af538cb50258653ac3afb8911876de7f0b2c5a31716d4cad22edf2cc3919292d
SSDEEP 196608:7KMfXEDFOIW6bnVSUsYBg13CuacYfNSr:7KKXEDFbW6bnVTulFa/k
TLSH
T17EE617B79B6196F6C66D3932D4A3E13F9E3940E3CF062EE3D1558919B9637D3903A080
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2088831

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

dinput8

DirectInput8Create

d3dx9_27

D3DXCreateEffectPool D3DXCreateEffect D3DXCreateBuffer D3DXCreateEffectCompilerFromFileA

d3d9

Direct3DCreate9

winmm

timeEndPeriod timeBeginPeriod timeSetEvent timeKillEvent timeGetTime

kernel32

CreateEventA CloseHandle OpenEventA GetModuleFileNameA ReadFile CreateFileA GetPrivateProfileIntA GetPrivateProfileStringA ReleaseMutex GetLastError CreateMutexA FormatMessageA CreateDirectoryA FindClose FindNextFileA FindFirstFileA GetFileSize DeleteFileA WriteFile GetLocalTime Sleep InitializeCriticalSection SetFilePointer LeaveCriticalSection EnterCriticalSection CreateThread TerminateThread DeleteCriticalSection WaitForSingleObject SetEvent lstrcpynA lstrlenA lstrcatA lstrcpyA GetModuleHandleA GetFullPathNameA MultiByteToWideChar WideCharToMultiByte FreeLibrary GetProcAddress LoadLibraryA VirtualQuery GetCurrentProcess SetUnhandledExceptionFilter SetLastError GetCurrentThread GetTickCount OutputDebugStringA QueryPerformanceFrequency PulseEvent ResumeThread GetFileTime GetComputerNameA SetEndOfFile FileTimeToSystemTime WritePrivateProfileStringA IsBadCodePtr IsBadReadPtr GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter LCMapStringW LCMapStringA GetFileType GetStdHandle SetHandleCount FlushFileBuffers GetStringTypeA IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy GetCPInfo GetOEMCP GetACP HeapSize GetSystemTimeAsFileTime TlsAlloc TlsGetValue TlsSetValue TlsFree GetVersionExA GetCommandLineA GetStartupInfoA TerminateProcess HeapReAlloc HeapFree HeapAlloc RaiseException ExitProcess RtlUnwind GetThreadContext GetStringTypeW VirtualProtect GetSystemInfo SetStdHandle QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId InterlockedDecrement InterlockedIncrement GetFileAttributesA GetLocaleInfoA ExitThread InterlockedExchange SetThreadAffinityMask SetThreadPriorityBoost GetOverlappedResult GetThreadPriority DebugBreak SleepEx SuspendThread GetProcessHeap SetThreadPriority

user32

GetIconInfo GetDC ReleaseDC DefWindowProcA SetCursor DestroyMenu GetCursorPos ScreenToClient LoadIconA LoadCursorA RegisterClassA SetRect AdjustWindowRect CreateWindowExA GetWindowLongA SetWindowPos GetClientRect SendMessageA LoadAcceleratorsA PeekMessageA TranslateAcceleratorA TranslateMessage DispatchMessageA SetWindowLongA SetMenu GetClassLongA GetWindowRect ClipCursor DestroyWindow GetMenu PostQuitMessage wsprintfA GetFocus MessageBoxA DestroyAcceleratorTable

gdi32

GetDIBits CreateCompatibleDC SelectObject DeleteObject DeleteDC GetStockObject GetObjectA

dsound

ord11

eax

ord6

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

PSFD00

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

PSFD_I

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

PSFD_P

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

PSFD_B

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

360KB

Virtual Size

357KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

408KB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.init

Size

60KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

2.8MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rld

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_026b04e1822b673a3fbab94058a52125_amadey_elex_plugx_remcos_smoke-loader

dinput8

d3dx9_27

d3d9

winmm

kernel32

user32

gdi32

dsound

eax

generic