2026-08-24_f51ea3b08fbd44f0761e38c3dd93cf27_amadey_elex_remcos_smoke-loader_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-24_f51ea3b08fbd44f0761e38c3dd93cf27_amadey_elex_remcos_smoke-loader_wannacry
Size 6.4MB
Sample260824-yprd4sshjd
SHA256 d5174093a08011b7ff40ffac401b420d46fbce54487b782c68967492e1507978
MD5 f51ea3b08fbd44f0761e38c3dd93cf27
SHA1 c5a060fac3fa5d5a87e9e8105569c4cc5bc519bb
SHA512 20c1de7c221e9a46a204933df610d91702741598b7ef1c88d7178735fe05652b98a784bfd65f4e7cf12a7d239eab74604ee7f77240283382f84a92b306ba32ce
SSDEEP 49152:BoT+qW6E2RbBG37OTr3hQ6K9dzJo0iGXEzSSd9fb5zo:/7n7UxPD5
TLSH
T14266D01EB3C301ABDBA256B0506A1B3A4A219B18133B57F3FF64DD96DD100C3B97619E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_f51ea3b08fbd44f0761e38c3dd93cf27_amadey_elex_remcos_smoke-loader_wannacry

File Explorer

2026-08-24_f51ea3b08fbd44f0761e38c3dd93cf27_amadey_elex_remcos_smoke-loader_wannacry

.exe 6.4MB

2026-08-24_f51ea3b08fbd44f0761e38c3dd93cf27_amadey_elex_remcos_smoke-loader_wannacry

SHA256 d5174093a08011b7ff40ffac401b420d46fbce54487b782c68967492e1507978
MD5 f51ea3b08fbd44f0761e38c3dd93cf27
SHA1 c5a060fac3fa5d5a87e9e8105569c4cc5bc519bb
SHA512 20c1de7c221e9a46a204933df610d91702741598b7ef1c88d7178735fe05652b98a784bfd65f4e7cf12a7d239eab74604ee7f77240283382f84a92b306ba32ce
SSDEEP 49152:BoT+qW6E2RbBG37OTr3hQ6K9dzJo0iGXEzSSd9fb5zo:/7n7UxPD5
TLSH
T14266D01EB3C301ABDBA256B0506A1B3A4A219B18133B57F3FF64DD96DD100C3B97619E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1367441

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text1

Size

192KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

960KB

Virtual Size

960KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mackt

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=7, id=105, version=2067,

count=42, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=177, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=7, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=13, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=5, productName=Unmarked objects (old),

count=75, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=95, version=2179,

count=2, id=25, version=9210,

count=2, id=93, version=2067,

count=17, id=93, version=2179,

count=260, id=1, productName=Unmarked objects,

count=299, id=100, version=3077,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,