2026-09-22_130aebb5ed56832ee0a2bab0f8d72d4e_amadey_dharma_elex_remcos_smoke-loader_stop

General

Target
2026-09-22_130aebb5ed56832ee0a2bab0f8d72d4e_amadey_dharma_elex_remcos_smoke-loader_stop
Size 279KB
Sample260922-keyhsabg66
SHA256 45c6700f1ff5155d769f5111e88d6cd78e655cba8d53664fe43472f87bdf1bba
MD5 130aebb5ed56832ee0a2bab0f8d72d4e
SHA1 07c1be1a8c67df9aced9c405ae1cda56c6ecaabb
SHA512 624da34f4aecd4aadcc5cbe6ca876a8e4d8cae6045d9552d05459e41bfae558e0c20ebe581748c8bc8ba00551d763649a783bb2be275d5e1fdc7d33d97dbe44f
SSDEEP 6144:UmvBdmPbZx+CKtd9s3hZ7cY6Q65hGWgz9Nu1OglCu3X9wp5XW:UCbGZxSz9s3hZ7kJ5hGWgz9l7mNwH
TLSH
T180548D10BA90D035E5B712F48A7A926DB93E3AA0673454CF62D517FE5738AE0EC3131B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-22_130aebb5ed56832ee0a2bab0f8d72d4e_amadey_dharma_elex_remcos_smoke-loader_stop

File Explorer

2026-09-22_130aebb5ed56832ee0a2bab0f8d72d4e_amadey_dharma_elex_remcos_smoke-loader_stop

.exe 279KB

2026-09-22_130aebb5ed56832ee0a2bab0f8d72d4e_amadey_dharma_elex_remcos_smoke-loader_stop

IMPHASH eab7d550b9cdca5c6bd9023d54b79da8
SHA256 45c6700f1ff5155d769f5111e88d6cd78e655cba8d53664fe43472f87bdf1bba
MD5 130aebb5ed56832ee0a2bab0f8d72d4e
SHA1 07c1be1a8c67df9aced9c405ae1cda56c6ecaabb
SHA512 624da34f4aecd4aadcc5cbe6ca876a8e4d8cae6045d9552d05459e41bfae558e0c20ebe581748c8bc8ba00551d763649a783bb2be275d5e1fdc7d33d97dbe44f
SSDEEP 6144:UmvBdmPbZx+CKtd9s3hZ7cY6Q65hGWgz9Nu1OglCu3X9wp5XW:UCbGZxSz9s3hZ7kJ5hGWgz9l7mNwH
TLSH
T180548D10BA90D035E5B712F48A7A926DB93E3AA0673454CF62D517FE5738AE0EC3131B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

46576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\fimolora\capawodixak\sesel.pdb

kernel32

OpenProcess GetNamedPipeHandleStateA GetQueuedCompletionStatus FillConsoleOutputCharacterA EnumSystemCodePagesW LocalLock GetVolumeNameForVolumeMountPointA GetVersionExA VerifyVersionInfoA WriteConsoleInputW EnumDateFormatsA FindNextFileA CopyFileExW BuildCommDCBAndTimeoutsA VirtualLock WriteProfileStringA VerifyVersionInfoW GetDriveTypeW GetFileInformationByHandle DeleteFileA FindNextVolumeMountPointW TlsGetValue ResetWriteWatch GetConsoleTitleW GetComputerNameExW GetTimeZoneInformation GetModuleHandleA GetSystemDirectoryA GetDriveTypeA LoadLibraryA GetShortPathNameW ReleaseActCtx GetProfileSectionW DeleteFileW GetCommandLineA InterlockedExchangeAdd InterlockedDecrement CreateActCtxW FindResourceA FormatMessageA GetModuleFileNameA CreateJobObjectW InitializeCriticalSection GetNumberOfConsoleMouseButtons FindNextVolumeA CreateNamedPipeW WritePrivateProfileStringA GetConsoleAliasesLengthW WriteProfileSectionW AddAtomA InterlockedIncrement GetVersionExW HeapFree _hread InterlockedCompareExchange GetStartupInfoW ConnectNamedPipe GetCPInfoExA GetSystemWow64DirectoryW GetLastError GetPrivateProfileIntW GetConsoleAliasExesW DebugBreak EndUpdateResourceA GetTickCount VirtualQueryEx DeleteVolumeMountPointA OpenFileMappingA GetModuleHandleW SetDefaultCommConfigA VirtualAlloc GetSystemWindowsDirectoryA TerminateProcess GetACP GetDiskFreeSpaceExA EnumResourceTypesA IsProcessInJob lstrcpynW WriteConsoleW GetProcAddress lstrcpyA LoadLibraryW ReadConsoleOutputW SetHandleInformation WritePrivateProfileSectionA DeleteCriticalSection GetFileAttributesA DeactivateActCtx CopyFileW GlobalMemoryStatus SetTapeParameters GetDevicePowerState ResetEvent LockFile MoveFileA DisableThreadLibraryCalls GetOverlappedResult SetCommTimeouts GlobalAlloc SetThreadPriorityBoost SetFileShortNameW GetFileAttributesW SetCalendarInfoA ConvertFiberToThread GetConsoleTitleA SetComputerNameW GetConsoleAliasesA SetConsoleOutputCP MoveFileWithProgressW GetStdHandle GetLocalTime EnumSystemLocalesW ActivateActCtx OpenSemaphoreA GetModuleHandleExA FoldStringW GetFileSize SetUnhandledExceptionFilter GetConsoleAliasesLengthA SetProcessShutdownParameters lstrcpynA GlobalUnWire FillConsoleOutputCharacterW GetCompressedFileSizeA ReadConsoleA FreeUserPhysicalPages WriteConsoleOutputCharacterW TerminateJobObject CreateFileA SetTimerQueueTimer SetLastError UnhandledExceptionFilter RaiseException GetStartupInfoA HeapValidate IsBadReadPtr EnterCriticalSection LeaveCriticalSection GetModuleFileNameW GetCurrentProcess IsDebuggerPresent CloseHandle SetStdHandle GetFileType WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode Sleep ExitProcess QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount TlsAlloc TlsSetValue TlsFree HeapDestroy HeapCreate VirtualFree HeapAlloc HeapSize HeapReAlloc GetOEMCP GetCPInfo IsValidCodePage RtlUnwind InitializeCriticalSectionAndSpinCount OutputDebugStringA OutputDebugStringW FlushFileBuffers WriteConsoleA GetConsoleOutputCP MultiByteToWideChar SetFilePointer LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

Name

.text

Size

186KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

70KB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.varak

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bowiye

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.jexi

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cove

Size

512B

Virtual Size

50B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_130aebb5ed56832ee0a2bab0f8d72d4e_amadey_dharma_elex_remcos_smoke-loader_stop

kernel32

generic