2026-08-10_339af382f1361fc10bb810fd7ec19c3f_amadey_elex_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_339af382f1361fc10bb810fd7ec19c3f_amadey_elex_remcos_smoke-loader
Size 14.5MB
Sample260810-2pg28avzcy
SHA256 26ca9b19078ebd7ac3d59bba7e6de0dc6025d79296590d8c2c367e617fca7e4a
MD5 339af382f1361fc10bb810fd7ec19c3f
SHA1 ba26ba06e47d4b023ef8917aefc7ca574736707a
SHA512 12d5f3b43112f6d8ba7db973ab48fdea573cab48300a11a8517b6d4a5752f0533ea6ccabe84eddb510de2b4da2191bee0919b17ba0c2e84ee57064d4fbac0240
SSDEEP 393216:iwnmPBJaXejhj9+W4Km4riolaK6lC0+Mp:TgGpGu0OYY
TLSH
T101E6F102F7C6C276C6D712B58499633D8276AB044B355AC3E7982F0FDE70BE2AD35285
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_339af382f1361fc10bb810fd7ec19c3f_amadey_elex_remcos_smoke-loader

File Explorer

2026-08-10_339af382f1361fc10bb810fd7ec19c3f_amadey_elex_remcos_smoke-loader

.exe 14.5MB

2026-08-10_339af382f1361fc10bb810fd7ec19c3f_amadey_elex_remcos_smoke-loader

IMPHASH 5b36115ff362711943f368adb695e60e
SHA256 26ca9b19078ebd7ac3d59bba7e6de0dc6025d79296590d8c2c367e617fca7e4a
MD5 339af382f1361fc10bb810fd7ec19c3f
SHA1 ba26ba06e47d4b023ef8917aefc7ca574736707a
SHA512 12d5f3b43112f6d8ba7db973ab48fdea573cab48300a11a8517b6d4a5752f0533ea6ccabe84eddb510de2b4da2191bee0919b17ba0c2e84ee57064d4fbac0240
SSDEEP 393216:iwnmPBJaXejhj9+W4Km4riolaK6lC0+Mp:TgGpGu0OYY
TLSH
T101E6F102F7C6C276C6D712B58499633D8276AB044B355AC3E7982F0FDE70BE2AD35285
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41598976

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateThread GlobalUnlock GlobalLock GlobalAlloc GetTickCount WideCharToMultiByte IsBadReadPtr GlobalAddAtomA GlobalAddAtomW GetModuleHandleA GlobalFree GlobalGetAtomNameA GlobalDeleteAtom GlobalGetAtomNameW FreeConsole GetEnvironmentVariableA VirtualProtect VirtualAlloc GetProcAddress GetLastError LoadLibraryA SetLastError SetThreadPriority GetCurrentThread CreateProcessA GetCommandLineA GetStartupInfoA SetEnvironmentVariableA ReleaseMutex WaitForSingleObject CreateMutexA OpenMutexA GetCurrentThreadId ReadFile GetFileSize CreateFileA FindClose FindFirstFileA FindFirstFileW VirtualQueryEx GetExitCodeProcess ReadProcessMemory UnmapViewOfFile ContinueDebugEvent SetThreadContext GetThreadContext WaitForDebugEvent CloseHandle DebugActiveProcess ResumeThread CreateProcessW GetCommandLineW GetStartupInfoW MapViewOfFile DuplicateHandle GetCurrentProcess CreateFileMappingA VirtualProtectEx WriteProcessMemory ExitProcess GetLocalTime CompareStringA FlushFileBuffers LCMapStringW LCMapStringA SetStdHandle GetOEMCP GetACP GetCPInfo CompareStringW GetStringTypeW GetStringTypeA MultiByteToWideChar SetFilePointer HeapReAlloc WriteFile VirtualFree HeapCreate HeapDestroy GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter HeapFree HeapAlloc GetVersion GetSystemTime GetTimeZoneInformation RtlUnwind TerminateProcess Sleep EnterCriticalSection LeaveCriticalSection GetVersionExA InitializeCriticalSection GetCurrentProcessId GetModuleFileNameW GetShortPathNameW GetModuleFileNameA SuspendThread GetShortPathNameA

user32

GetDesktopWindow MoveWindow SetPropA EnumThreadWindows GetPropA GetMessageA BeginPaint EndPaint KillTimer GetAsyncKeyState GetSystemMetrics SetTimer SetWindowTextA GetDlgItem CreateDialogIndirectParamA ShowWindow UpdateWindow LoadStringA LoadStringW FindWindowA WaitForInputIdle DestroyWindow MessageBoxA InSendMessage UnpackDDElParam FreeDDElParam DefWindowProcA LoadCursorA RegisterClassW CreateWindowExW RegisterClassA CreateWindowExA GetWindowThreadProcessId SendMessageW SendMessageA TranslateMessage DispatchMessageA EnumWindows IsWindowUnicode PackDDElParam PostMessageW PostMessageA IsWindow PeekMessageA

gdi32

DeleteDC RealizePalette SelectPalette CreateDCA CreatePalette DeleteObject BitBlt SelectObject CreateCompatibleDC CreateDIBitmap

Name

.text

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

768KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

279KB

Virtual Size

32.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text1

Size

268KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

48KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

40KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6.7MB

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

280KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=72, id=125, productName=VS2005 build 50727, version=50727,

count=2, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=28, version=9178,

count=9, id=95, version=2067,

count=6, id=18, version=8444,

count=109, id=29, version=9178,

count=1, id=95, version=2179,

count=2, id=93, version=2067,

count=4, id=25, version=9210,

count=45, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=239, id=110, productName=VS2005 build 50727, version=50727,

count=311, id=109, productName=VS2005 build 50727, version=50727,

count=19, id=93, version=2179,

count=270, id=1, productName=Unmarked objects,

count=249, id=114, version=50727,

count=1, id=124, productName=VS2005 build 50727, version=50727,

count=32, productName=Unmarked objects (old),

count=1, id=120, productName=VS2005 build 50727, version=50727,