2026-08-06_5a187c9ba9b353dfe6e4bad778bd3129_amadey_elex_floxif_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_5a187c9ba9b353dfe6e4bad778bd3129_amadey_elex_floxif_remcos_smoke-loader_stop
Size 686KB
Sample260807-a39wlsdn3t
SHA256 75989029f31460a2a133977c434e28e70513c705ecd22af2a9e48bdd123c7955
MD5 5a187c9ba9b353dfe6e4bad778bd3129
SHA1 beaefce06027578465fadf511d119360fe1713a0
SHA512 c0a1eb6c4eec85b0b3cb0d43141db1c55f4689215c4a57e628f9bb5647470605908ec1a99fd8e5d1fed31ec9f716957ea6aa18d9171a6eb8600230ef9f724c4b
SSDEEP 12288:S2fApoKpaMYITQa9r5OiWZQrU7lBjvrEH7p:woQaMbQ/7LrEH7p
TLSH
T130E41A82739A8FB4EEBBC33711092D0F15427D6D542204AA6FCEBA1D8DF9601572E736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-06_5a187c9ba9b353dfe6e4bad778bd3129_amadey_elex_floxif_remcos_smoke-loader_stop

File Explorer

2026-08-06_5a187c9ba9b353dfe6e4bad778bd3129_amadey_elex_floxif_remcos_smoke-loader_stop

.exe 686KB

2026-08-06_5a187c9ba9b353dfe6e4bad778bd3129_amadey_elex_floxif_remcos_smoke-loader_stop

IMPHASH b0db1b7e4a1c9870aa729a26ecafaabb
SHA256 75989029f31460a2a133977c434e28e70513c705ecd22af2a9e48bdd123c7955
MD5 5a187c9ba9b353dfe6e4bad778bd3129
SHA1 beaefce06027578465fadf511d119360fe1713a0
SHA512 c0a1eb6c4eec85b0b3cb0d43141db1c55f4689215c4a57e628f9bb5647470605908ec1a99fd8e5d1fed31ec9f716957ea6aa18d9171a6eb8600230ef9f724c4b
SSDEEP 12288:S2fApoKpaMYITQa9r5OiWZQrU7lBjvrEH7p:woQaMbQ/7LrEH7p
TLSH
T130E41A82739A8FB4EEBBC33711092D0F15427D6D542204AA6FCEBA1D8DF9601572E736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3b:4f:1c:22:0c:0d:36:c6:a9:af:ac:f0:57:2a:3c:a7:48:e0:63:70

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Chains

Jul 25, 2013

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Serial Number

29:66:2a:74:5c:40:15:70:38:f2:78:9d:69:05:e9:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 21, 2012 - Aug 23, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

141858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcessHeap GetStartupInfoW RtlUnwind RaiseException HeapReAlloc ExitProcess HeapSize VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter HeapAlloc TerminateProcess UnhandledExceptionFilter IsDebuggerPresent Sleep GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA HeapFree GetFileTime FileTimeToLocalFileTime GetTickCount SetErrorMode GetFullPathNameW GetVolumeInformationW DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers ReadFile WritePrivateProfileStringW FileTimeToSystemTime GetThreadLocale InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GlobalFlags GetCurrentThread ConvertDefaultLocale GetVersion EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange InterlockedDecrement GetCurrentProcessId GetModuleHandleA GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree MulDiv FreeResource GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom FreeLibrary CompareStringW LoadLibraryA lstrcmpW MultiByteToWideChar GetVersionExA SetLastError LoadLibraryW lstrcpynW GetCurrentProcess GetTempPathW CreateMutexW GetLocalTime WideCharToMultiByte GetSystemDefaultLangID GetExitCodeProcess GetModuleHandleW GetProcAddress CreateFileW lstrlenA FindFirstFileW FindClose lstrlenW GetModuleFileNameW GetFileAttributesW WaitForSingleObject GetVersionExW GetLastError CloseHandle SetFilePointer WriteFile CreateDirectoryW LoadResource SizeofResource LockResource FindResourceW GetPrivateProfileStringW lstrcmpiW GetSystemTimeAsFileTime GetPrivateProfileSectionW

user32

RegisterClipboardFormatW PostThreadMessageW CopyAcceleratorTableW CharNextW ReleaseCapture SetCapture UnregisterClassW LoadCursorW GetSysColorBrush DestroyMenu SetWindowContextHelpId MapDialogRect SetCursor GetMessageW GetCursorPos ValidateRect PostQuitMessage GetDesktopWindow GetActiveWindow CreateDialogIndirectParamW GetNextDlgTabItem EndDialog EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW GetMenuState EnableMenuItem CheckMenuItem IsWindowEnabled ShowWindow MoveWindow IsDialogMessageW RegisterWindowMessageW LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetFocus SetFocus GetWindowTextLengthW GetWindowTextW GetLastActivePopup GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints GetKeyState IsWindowVisible GetMenu PostMessageW GetSubMenu GetMenuItemID GetMenuItemCount CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx GetParent EqualRect PtInRect GetDlgCtrlID CharUpperW MessageBeep DefWindowProcW CallWindowProcW GetNextDlgGroupItem InvalidateRgn InvalidateRect SetRect SetWindowTextW IsRectEmpty GetWindowLongW SetWindowLongW OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow ReleaseDC GetDC CopyRect IsWindow SetForegroundWindow GetForegroundWindow DispatchMessageW MessageBoxW SetWindowPos GetWindowThreadProcessId PeekMessageW wsprintfW SetActiveWindow TranslateMessage GetSystemMetrics ExitWindowsEx AttachThreadInput UpdateWindow SendMessageW EnableWindow GetClientRect GetCapture UnregisterClassA

gdi32

DeleteDC GetWindowExtEx GetStockObject ExtSelectClipRgn GetMapMode GetBkColor GetTextColor GetRgnBox GetViewportExtEx DeleteObject ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible SetMapMode RestoreDC SaveDC GetDeviceCaps CreateBitmap GetObjectW SetBkColor SetTextColor GetClipBox CreateRectRgnIndirect

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegOpenKeyW AllocateAndInitializeSid RegCloseKey AdjustTokenPrivileges OpenProcessToken RegCreateKeyExW EqualSid LookupPrivilegeValueW GetTokenInformation FreeSid RegSetValueExW

shell32

ShellExecuteExW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW PathStripToRootW PathFindExtensionW PathIsUNCW

oledlg

OleUIBusyW

ole32

OleInitialize CoFreeUnusedLibraries OleUninitialize CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CoRevokeClassObject CoTaskMemAlloc CoTaskMemFree OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter CLSIDFromProgID

oleaut32

SysAllocString OleCreateFontIndirect SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy VariantCopy SysFreeString SysStringLen VariantInit VariantChangeType VariantClear SysAllocStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_5a187c9ba9b353dfe6e4bad778bd3129_amadey_elex_floxif_remcos_smoke-loader_stop

PE Signature issue

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

generic