2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader
Size 1.5MB
Sample260822-hw6vdaee28
SHA256 c95782355f25e9a829bb0c45bb7243ffba82732f215c4c6d7aa21700bda23f03
MD5 bae2d6d3c782733aa49a7df35e8a7796
SHA1 c4a5f9f4ce6de7d6bab77dc7de27264c1915dd65
SHA512 e2f781ed05f73714528199af8efb768b831c74fd5b5914a2d178f9e53daac97f8976c9a1e85affa3f4ac515d8a71f8a4b57a10af9bd13703b187ebc9a80d9c54
SSDEEP 12288:UcRj0PR+sW0ZWENh+wCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:UcWPRfLt+w2cQZXNbpInm2cn8cGorz
TLSH
T15365021131C1C8B7C13215310CE4D6B5A17ABDA10B954EBB7BB11B2E4F7C5E2AB24DBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader

File Explorer

2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader

.exe 1.5MB

2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader

IMPHASH eb17abeb74320d5ae18d850c0775053b
SHA256 c95782355f25e9a829bb0c45bb7243ffba82732f215c4c6d7aa21700bda23f03
MD5 bae2d6d3c782733aa49a7df35e8a7796
SHA1 c4a5f9f4ce6de7d6bab77dc7de27264c1915dd65
SHA512 e2f781ed05f73714528199af8efb768b831c74fd5b5914a2d178f9e53daac97f8976c9a1e85affa3f4ac515d8a71f8a4b57a10af9bd13703b187ebc9a80d9c54
SSDEEP 12288:UcRj0PR+sW0ZWENh+wCpcE+ElH/M8pNbpIcMmm6pOaycdCun/UcGorz:UcWPRfLt+w2cQZXNbpInm2cn8cGorz
TLSH
T15365021131C1C8B7C13215310CE4D6B5A17ABDA10B954EBB7BB11B2E4F7C5E2AB24DBA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50195

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle WideCharToMultiByte GetModuleFileNameA Process32First TerminateProcess CreateMutexA OpenProcess CreateToolhelp32Snapshot GetSystemWow64DirectoryW Sleep CopyFileA GetLastError GlobalAlloc Process32Next SetFileAttributesA GlobalLock CreateFileA GlobalUnlock IsDebuggerPresent CreateFileW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage MultiByteToWideChar WriteFile CreateDirectoryA FindNextFileA FindFirstFileExA FindClose GetFileType GetProcessHeap EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetCurrentProcess RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW HeapAlloc HeapFree HeapReAlloc GetStdHandle WriteConsoleW

user32

SetClipboardData SendMessageA GetClipboardData CharToOemA FindWindowA MessageBoxA GetWindowTextA EmptyClipboard CloseClipboard OpenClipboard MessageBeep IsClipboardFormatAvailable GetForegroundWindow EnumDisplayDevicesA

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

shell32

ShellExecuteA

ole32

CoCreateInstance CoUninitialize

wininet

InternetSetFilePointer InternetReadFile InternetConnectA HttpQueryInfoA HttpOpenRequestA InternetOpenUrlA InternetSetOptionA InternetCloseHandle HttpAddRequestHeadersA InternetOpenA HttpSendRequestA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_bae2d6d3c782733aa49a7df35e8a7796_amadey_elex_remcos_smoke-loader

kernel32

user32

advapi32

shell32

ole32

wininet

generic