2026-10-01_32571ef3464275e1c7ccf6ee761ddefe_amadey_elex_remcos_smoke-loader

General

Target
2026-10-01_32571ef3464275e1c7ccf6ee761ddefe_amadey_elex_remcos_smoke-loader
Size 342KB
Sample261002-vm7frsss8p
SHA256 ed39d67791276294e241a3f06d8b955af162869662f0c7bafa47911435d6270c
MD5 32571ef3464275e1c7ccf6ee761ddefe
SHA1 c0042374346607b2e977ce22d08661647962ed86
SHA512 0182a37a87d9b69493364459d17652ca8020cab1a1d4747fdd36b6842a8d8d904dd3e974c793f05ed3571b688fc8ca1a342a4a5e3cafa4876452457047ec86a6
SSDEEP 6144:ZJw9n+1EJDbQiNQql2d2pkxBmorz/DOjNgfgp74Bzt:Z+9+1EJDfmd2KxBmorz/DOjNz4BJ
TLSH
T1D7748D00A7A1C03DF1B252F879B69279B53E7DA1AB3450CF52D62AEE56346E0EC71307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_32571ef3464275e1c7ccf6ee761ddefe_amadey_elex_remcos_smoke-loader

File Explorer

2026-10-01_32571ef3464275e1c7ccf6ee761ddefe_amadey_elex_remcos_smoke-loader

.exe 342KB

2026-10-01_32571ef3464275e1c7ccf6ee761ddefe_amadey_elex_remcos_smoke-loader

IMPHASH 2c19e8d727961fe75bcdcd452c23e64c
SHA256 ed39d67791276294e241a3f06d8b955af162869662f0c7bafa47911435d6270c
MD5 32571ef3464275e1c7ccf6ee761ddefe
SHA1 c0042374346607b2e977ce22d08661647962ed86
SHA512 0182a37a87d9b69493364459d17652ca8020cab1a1d4747fdd36b6842a8d8d904dd3e974c793f05ed3571b688fc8ca1a342a4a5e3cafa4876452457047ec86a6
SSDEEP 6144:ZJw9n+1EJDbQiNQql2d2pkxBmorz/DOjNgfgp74Bzt:Z+9+1EJDfmd2KxBmorz/DOjNz4BJ
TLSH
T1D7748D00A7A1C03DF1B252F879B69279B53E7DA1AB3450CF52D62AEE56346E0EC71307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

118112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\nuwaz\kadexamo_paze\defafico57-yizu_zakeyevukat.pdb

kernel32

FindFirstChangeNotificationW GetConsoleAliasesLengthW TlsGetValue GetCPInfo ReadConsoleA InterlockedDecrement GetSystemWindowsDirectoryW SetHandleInformation BackupSeek FreeEnvironmentStringsA IsBadReadPtr GetConsoleAliasesLengthA GetPrivateProfileStringW CreateActCtxW TlsSetValue ActivateActCtx GlobalAlloc GetSystemDirectoryW LoadLibraryW ReadConsoleInputA GetSystemWow64DirectoryW SetVolumeMountPointA SetDllDirectoryA SetConsoleMode HeapValidate SetConsoleCursorPosition VerifyVersionInfoA GetStartupInfoW WritePrivateProfileStringW GetNamedPipeHandleStateW GetPrivateProfileIntW FindFirstFileExA GetLastError IsDBCSLeadByteEx GetCurrentDirectoryW SetLastError GetProcAddress SetFirmwareEnvironmentVariableW GlobalGetAtomNameA BuildCommDCBW OpenWaitableTimerA OpenWaitableTimerW WriteProfileSectionW SetEnvironmentVariableA GetModuleFileNameA GetOEMCP SetConsoleCursorInfo CompareStringA GetFileTime SetProcessShutdownParameters SetFileShortNameA GetVersionExA GetWindowsDirectoryW GetSystemTime GetProfileSectionW DeleteFileA LocalFileTimeToFileTime CloseHandle SetStdHandle MoveFileA GetCommandLineW HeapSetInformation IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection DecodePointer TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer GetModuleFileNameW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime InterlockedIncrement GetModuleHandleW ExitProcess FreeEnvironmentStringsW GetEnvironmentStringsW TlsAlloc TlsFree HeapCreate WriteFile OutputDebugStringA WriteConsoleW OutputDebugStringW RtlUnwind MultiByteToWideChar GetACP IsValidCodePage RaiseException SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode HeapAlloc HeapReAlloc HeapSize HeapQueryInformation HeapFree FlushFileBuffers GetStringTypeW LCMapStringW ReadFile CreateFileW

user32

GetCursorInfo GetMessagePos

winhttp

WinHttpCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_32571ef3464275e1c7ccf6ee761ddefe_amadey_elex_remcos_smoke-loader

kernel32

user32

winhttp

generic