2026-08-11_ed1a55ae3e9d245ae0232e96429ffe90_amadey_elex_remcos_smoke-loader

General

Target
2026-08-11_ed1a55ae3e9d245ae0232e96429ffe90_amadey_elex_remcos_smoke-loader
Size 832KB
Sample260811-ckvp3sdr21
SHA256 1fa96e1fc1ef603278b00f81ddb1d4e15b73605ae39fb28defe78ed0fda6c93e
MD5 ed1a55ae3e9d245ae0232e96429ffe90
SHA1 61688231ca33bcd74c94356429a4cf34a87d317a
SHA512 622fe62c6313856101bdc44a2218ce4248c1b82c3b4096d37794a0f12200c849c4b37e003fed7fd6306079703ae639f11f29c1c72f4cac6900de8f1089382d2b
SSDEEP 6144:QsngqCk30SjEg7mHTfWFH6G1m4VQ7SHrbD6mgFp:QKgdk3RQg7mHTfWFHfm4VjLbDCT
TLSH
T173056C10B7A0D039F1B316F44AB99279A52FBEE16B2491CB53D52BEE96355D0EC3030B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_ed1a55ae3e9d245ae0232e96429ffe90_amadey_elex_remcos_smoke-loader

File Explorer

2026-08-11_ed1a55ae3e9d245ae0232e96429ffe90_amadey_elex_remcos_smoke-loader

.exe 832KB

2026-08-11_ed1a55ae3e9d245ae0232e96429ffe90_amadey_elex_remcos_smoke-loader

IMPHASH e6044139e58ab69adfc8f485b6284847
SHA256 1fa96e1fc1ef603278b00f81ddb1d4e15b73605ae39fb28defe78ed0fda6c93e
MD5 ed1a55ae3e9d245ae0232e96429ffe90
SHA1 61688231ca33bcd74c94356429a4cf34a87d317a
SHA512 622fe62c6313856101bdc44a2218ce4248c1b82c3b4096d37794a0f12200c849c4b37e003fed7fd6306079703ae639f11f29c1c72f4cac6900de8f1089382d2b
SSDEEP 6144:QsngqCk30SjEg7mHTfWFH6G1m4VQ7SHrbD6mgFp:QKgdk3RQg7mHTfWFHfm4VjLbDCT
TLSH
T173056C10B7A0D039F1B316F44AB99279A52FBEE16B2491CB53D52BEE96355D0EC3030B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

146288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\haneloyiyav jitebibojo.pdb

kernel32

GetNamedPipeHandleStateW CreateNamedPipeA CallNamedPipeA TerminateThread GetExitCodeProcess GetVersionExW VerifyVersionInfoW SetConsoleCP GetConsoleAliasesLengthA VerLanguageNameW FindFirstFileExA FreeEnvironmentStringsA GetProcessPriorityBoost SetVolumeMountPointW GetLongPathNameW CopyFileA TlsSetValue SetConsoleCursorInfo TzSpecificLocalTimeToSystemTime SetProcessShutdownParameters ReleaseMutex BuildCommDCBAndTimeoutsA GetProcAddress LoadLibraryA LocalAlloc SleepEx MoveFileA GetCommandLineW InterlockedDecrement DeleteFileA CreateActCtxW SetFileAttributesA GetPrivateProfileIntA GetProcessHeap ReadConsoleOutputCharacterA GetStartupInfoA GetDiskFreeSpaceExA GetCPInfoExW GetWindowsDirectoryA GetSystemWow64DirectoryA SetLastError GetProfileStringA GetCalendarInfoW GetTickCount GetStringTypeA DebugBreak FindFirstFileA WriteFileGather WriteFile GetConsoleMode lstrcatW InitializeSListHead InterlockedExchange SetCriticalSectionSpinCount DefineDosDeviceW WriteConsoleW InterlockedIncrement GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileStructA TryEnterCriticalSection GetPrivateProfileStructW GetFileAttributesExW HeapWalk CreateIoCompletionPort PeekConsoleInputA GetNumberFormatA FindResourceExW SetLocalTime GetQueuedCompletionStatus CreateSemaphoreA GetThreadLocale SetFileShortNameW lstrcpyW ReplaceFileA MoveFileExW GetConsoleCP GetVolumePathNameA FlushConsoleInputBuffer SearchPathW FreeConsole GetConsoleAliasExesLengthA WriteConsoleInputA LocalShrink GetCommState EnumSystemLocalesW ProcessIdToSessionId SetMessageWaitingIndicator GetWriteWatch RaiseException OpenSemaphoreW GetConsoleScreenBufferInfo ClearCommError ReleaseActCtx GetSystemTimeAdjustment OpenMutexA GetComputerNameW HeapValidate GetLastError OpenMutexW GetStringTypeW SetSystemPowerState VirtualLock SetWaitableTimer ChangeTimerQueueTimer GetProcessHandleCount FatalAppExitA lstrcpynW SetNamedPipeHandleState FillConsoleOutputCharacterW GetCompressedFileSizeA FindNextVolumeMountPointW GetFullPathNameA WriteProfileStringW GlobalAddAtomW LeaveCriticalSection SetCurrentDirectoryW LockFile InitializeCriticalSection DeleteCriticalSection EnterCriticalSection EncodePointer DecodePointer IsBadReadPtr RtlUnwind GetModuleHandleW ExitProcess HeapSetInformation GetStartupInfoW WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo GetModuleFileNameW InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent HeapAlloc GetModuleFileNameA HeapReAlloc HeapSize HeapQueryInformation TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree HeapCreate GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue GetCurrentThreadId TlsFree GetStdHandle LoadLibraryW GetLocaleInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetLocaleInfoA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID OutputDebugStringA OutputDebugStringW SetFilePointer SetStdHandle CreateFileW CloseHandle FlushFileBuffers

Name

.text

Size

251KB

Virtual Size

252KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

540KB

Virtual Size

540KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.biwif

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.powe

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_ed1a55ae3e9d245ae0232e96429ffe90_amadey_elex_remcos_smoke-loader

kernel32

generic