2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop
Size 940KB
Sample260928-pff3catarh
SHA256 2aa1927c0896b51c125b131817d3c8db73dca2fa4167f4b6ee21601bddd50ee0
MD5 c01d40f5eeb76b51475393f1df94ae97
SHA1 66515a47eb09327af395c0ad46486314c30884a2
SHA512 a967729e04038e5fdfc2f139b95a2175e1e122765182b59cee3581c89a3af0b40427d590943e18aa79b75719d6292dcd1c8461239d4853f01d6311b0c74c994c
SSDEEP 24576:Np7oJgqmibTfmgXe4i7ojhsP5Lgrk1TWb4AN5:7kJgy/fpe30jaNf1TWbdz
TLSH
T1C3251251FBC3C4F2E89601F944F287B68E726A95133154F36BE02E898C646F1AB77349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop

File Explorer

2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop

.exe 940KB

2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop

IMPHASH ac5c892e7b980c15a4cc540bc9a46079
SHA256 2aa1927c0896b51c125b131817d3c8db73dca2fa4167f4b6ee21601bddd50ee0
MD5 c01d40f5eeb76b51475393f1df94ae97
SHA1 66515a47eb09327af395c0ad46486314c30884a2
SHA512 a967729e04038e5fdfc2f139b95a2175e1e122765182b59cee3581c89a3af0b40427d590943e18aa79b75719d6292dcd1c8461239d4853f01d6311b0c74c994c
SSDEEP 24576:Np7oJgqmibTfmgXe4i7ojhsP5Lgrk1TWb4AN5:7kJgy/fpe30jaNf1TWbdz
TLSH
T1C3251251FBC3C4F2E89601F944F287B68E726A95133154F36BE02E898C646F1AB77349
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

185536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\work\software\common\Utils\ScriptApps\ntScrubber\release\ntScrubber.pdb

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

setupapi

SetupGetIntField SetupGetLineTextA SetupCloseInfFile SetupFindFirstLineA SetupOpenInfFileA SetupDiDestroyDriverInfoList SetupDiGetDriverInfoDetailA SetupDiEnumDriverInfoA SetupDiBuildDriverInfoList SetupDiSetDeviceInstallParamsA SetupDiGetDeviceRegistryPropertyA SetupDiOpenDevRegKey SetupDiGetDeviceInstallParamsA SetupFindNextLine SetupGetStringFieldA SetupGetLineCountA SetupGetFieldCount SetupDiGetClassDevsA SetupDiEnumDeviceInfo SetupDiRemoveDevice SetupDiDestroyDeviceInfoList

advapi32

InitiateSystemShutdownA RegOpenKeyExA RegDeleteValueA DeleteService ControlService OpenSCManagerA OpenServiceA StartServiceA QueryServiceStatusEx CloseServiceHandle RegisterEventSourceA ReportEventA DeregisterEventSource RegQueryValueExA RegDeleteKeyA GetTokenInformation SetEntriesInAclA SetSecurityInfo LookupPrivilegeValueA OpenProcessToken AdjustTokenPrivileges RegEnumValueA RegEnumKeyExA RegQueryInfoKeyA RegCreateKeyExA RegCloseKey RegSetValueExA

user32

MessageBoxA GetDesktopWindow EnumWindows GetSystemMetrics PostMessageA GetWindowThreadProcessId

shell32

ShellExecuteExA SHGetFolderPathA

winspool.drv

ClosePrinter DeletePrinter OpenPrinterA DeletePrinterDriverExA GetPrinterDriverDirectoryA EnumPrintProcessorsA DeleteMonitorA EnumMonitorsA GetPrintProcessorDirectoryA EnumPrinterDriversA DeletePrintProcessorA EnumPrintersA

mscms

GetColorDirectoryA

shlwapi

SHDeleteKeyA

difxapi

DriverPackageUninstallA

kernel32

GetConsoleCP GetConsoleMode FlushFileBuffers GetCurrentProcessId CreatePipe GetExitCodeProcess RaiseException SetFilePointer GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter SetStdHandle GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW InitializeCriticalSection WriteFile LCMapStringW LCMapStringA GetTimeZoneInformation WideCharToMultiByte GetStartupInfoA GetFileType GetStdHandle SetHandleCount HeapSize VirtualAlloc VirtualFree HeapCreate HeapDestroy DeleteCriticalSection ReadFile CompareStringW MultiByteToWideChar CompareStringA GetCurrentThreadId SetLastError TlsFree TlsSetValue SetEndOfFile GetTempPathA FreeLibrary FormatMessageA GetLastError LoadLibraryA GetProcAddress GetModuleFileNameA FindClose FindNextFileA FindFirstFileA GetEnvironmentVariableA SetEnvironmentVariableA CloseHandle GetCurrentProcess GetFileAttributesA CopyFileA CreateDirectoryA SetFileAttributesA GetSystemInfo GetModuleHandleA GetVersionExA GetWindowsDirectoryA GetSystemDirectoryA GetSystemWindowsDirectoryA GetLongPathNameA GetCurrentDirectoryA WaitForSingleObject CreateProcessA LocalFree DuplicateHandle OpenProcess Process32Next lstrcmpiA Process32First CreateToolhelp32Snapshot TerminateProcess lstrcmpA GetFullPathNameA RemoveDirectoryA MoveFileExA DeleteFileA SetCurrentDirectoryA FileTimeToSystemTime GetFileTime CreateFileA GetShortPathNameA GetBinaryTypeA SearchPathA GetDiskFreeSpaceExA Sleep GetTickCount ReleaseMutex CreateMutexA HeapReAlloc HeapAlloc HeapFree GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection ExitProcess RtlUnwind MoveFileA GetTimeFormatA GetDateFormatA InterlockedIncrement InterlockedDecrement SetConsoleCtrlHandler GetCommandLineA GetProcessHeap UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_c01d40f5eeb76b51475393f1df94ae97_amadey_elex_remcos_smoke-loader_stop

version

setupapi

advapi32

user32

shell32

winspool.drv

mscms

shlwapi

difxapi

kernel32

generic