2026-09-16_7a83881e60a6e0d44ea4ce9e80208940_amadey_elex_floxif_remcos_smoke-loader

General

Target
2026-09-16_7a83881e60a6e0d44ea4ce9e80208940_amadey_elex_floxif_remcos_smoke-loader
Size 298KB
Sample260916-yzkdjsfk9s
SHA256 98e9e17aeb5a049959a978504dfb87d38abd7e79c552b93a67770d5456808b55
MD5 7a83881e60a6e0d44ea4ce9e80208940
SHA1 6f1b3f34960cc5f71563528386c9743faf7cfd82
SHA512 a2191bca1334f0dcf61fb0f62dd0e0f82f4dfa38a187f7f630ef5ec504ddde4c40a96d12f2c994136801c167577be885ec5167f3997dbf88689fdb2d826a43c2
SSDEEP 6144:/zFPRsGl5uVle6Zqj96gPAOj4OWxaIkAtJtBV+UdvrEFp7hKB:7NR9l5uhwnuJtJtBjvrEH72
TLSH
T17054AE0135D187FAD073153138F8A6756AFEB93E09778AAF23A4071E4F7C281D625B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-16_7a83881e60a6e0d44ea4ce9e80208940_amadey_elex_floxif_remcos_smoke-loader

File Explorer

2026-09-16_7a83881e60a6e0d44ea4ce9e80208940_amadey_elex_floxif_remcos_smoke-loader

.exe 298KB

2026-09-16_7a83881e60a6e0d44ea4ce9e80208940_amadey_elex_floxif_remcos_smoke-loader

IMPHASH 68ac1a56baf9786bd6cf5f21e4340de5
SHA256 98e9e17aeb5a049959a978504dfb87d38abd7e79c552b93a67770d5456808b55
MD5 7a83881e60a6e0d44ea4ce9e80208940
SHA1 6f1b3f34960cc5f71563528386c9743faf7cfd82
SHA512 a2191bca1334f0dcf61fb0f62dd0e0f82f4dfa38a187f7f630ef5ec504ddde4c40a96d12f2c994136801c167577be885ec5167f3997dbf88689fdb2d826a43c2
SSDEEP 6144:/zFPRsGl5uVle6Zqj96gPAOj4OWxaIkAtJtBV+UdvrEFp7hKB:7NR9l5uhwnuJtJtBjvrEH72
TLSH
T17054AE0135D187FAD073153138F8A6756AFEB93E09778AAF23A4071E4F7C281D625B26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

c1:14:ae:67:95:6d:77:08:1d:e6:ef:da:8d:9d:b8:67:44:f5:fc:52:cc:be:7c:ba:44:f2:96:67:c6:f9:eb:86

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 5, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:cd:f3:64:bf:f8:d4:4c:5d:51:00:00:00:00:02:cd

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 12, 2022 - May 11, 2023

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ba:1f:3f:19:f7:c1:75:bd:7c:00:01:00:00:01:ba

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 20, 2022 - Dec 14, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

6

Entry point

41924

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\dbs\sh\ddvsm\0405_132853\cmd\3j\out\binaries\x86ret\bin\i386\VsJustInTimeDebuggerRegistrationHelper.pdb

kernel32

GetProcAddress FormatMessageW GetModuleHandleW CompareStringEx LCMapStringEx ExpandEnvironmentStringsW DecodePointer DeleteCriticalSection InitializeCriticalSectionEx GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP HeapFree GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode HeapAlloc ReadFile SetFilePointerEx CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CloseHandle HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW HeapSize ReadConsoleW WriteConsoleW CreateFileW SetEndOfFile

advapi32

RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegCloseKey RegSetValueExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_7a83881e60a6e0d44ea4ce9e80208940_amadey_elex_floxif_remcos_smoke-loader

PE Signature issue

kernel32

advapi32

generic