General
- Target 2026-10-01_6e63f09a9d0556ca667ec6dbb5ba6266_amadey_elex_remcos_smoke-loader
- Size 2.4MB
- Sample261002-ppsshatz6k
- SHA256 fdcf7bde46d692d663fddd2c953dc15c1eee8cc804b14bd1ea5f5086b04d7d59
- MD5 6e63f09a9d0556ca667ec6dbb5ba6266
- SHA1 8d727e8be9a8d1e93251af2ffcff8a75a7494d1d
- SHA512 742cbcafcab7e4a12f4e605772df78989272170696f69feb7f4610260c11b72547f1c6e31b3b7c35b5f54366b89b7a91233ab21b8f8e2a81a49e599b6898f045
- SSDEEP 24576:tENJKEt6dq8hXj8R2vxW870KHFe5GqR6FokG81Cvz44sLy0aZJQ5Te6LO:tENwzIR257BkIqR6FoRvku04YL
- TLSH T16AC52910B750C018FAA712B55EADE1BC95187DB08BA850CBB1DD7BFE67366E02D32247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_6e63f09a9d0556ca667ec6dbb5ba6266_amadey_elex_remcos_smoke-loader.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_6e63f09a9d0556ca667ec6dbb5ba6266_amadey_elex_remcos_smoke-loader.exe
Resource
win11ltsc2024-20260911-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-01_6e63f09a9d0556ca667ec6dbb5ba6266_amadey_elex_remcos_smoke-loader
- Size 2.4MB
- SHA256 fdcf7bde46d692d663fddd2c953dc15c1eee8cc804b14bd1ea5f5086b04d7d59
- MD5 6e63f09a9d0556ca667ec6dbb5ba6266
- SHA1 8d727e8be9a8d1e93251af2ffcff8a75a7494d1d
- SHA512 742cbcafcab7e4a12f4e605772df78989272170696f69feb7f4610260c11b72547f1c6e31b3b7c35b5f54366b89b7a91233ab21b8f8e2a81a49e599b6898f045
- SSDEEP 24576:tENJKEt6dq8hXj8R2vxW870KHFe5GqR6FokG81Cvz44sLy0aZJQ5Te6LO:tENwzIR257BkIqR6FoRvku04YL
- TLSH T16AC52910B750C018FAA712B55EADE1BC95187DB08BA850CBB1DD7BFE67366E02D32247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory