2026-10-02_bb44f6ba42db0c35bbfcb6ee81e6fb27_amadey_dharma_elex_remcos_smoke-loader_stop

General

Target
2026-10-02_bb44f6ba42db0c35bbfcb6ee81e6fb27_amadey_dharma_elex_remcos_smoke-loader_stop
Size 391KB
Sample261003-e7zzessvat
SHA256 6b16b26d373b9477461dc7feb8464b684cab80682ba3a1da1e0d9629ff2e5d5d
MD5 bb44f6ba42db0c35bbfcb6ee81e6fb27
SHA1 b8ddb86ab421b6c0640afe23c248b8bc015b3afc
SHA512 d83be36d148fa7a8725c2216402f74fc46185883c83323fb51b251b6cad7bb88a91b582ed71260fe236ba413a012b7ff81c0d73d33a1d1bc1fcaa3bf2b7828b7
SSDEEP 6144:BYxw/CFd33GvegoUSbsiK2t8VlpIftMqTDvaGDmIY0oHJhgoGhPQ3rZY:BYyod33Gvego/Ft8kG8OIZoHJhgTPOa
TLSH
T10F84BE20B690C034F5B752F44AB69328B92F7AA1A73451CF52E416EE57387E5EC3270B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_bb44f6ba42db0c35bbfcb6ee81e6fb27_amadey_dharma_elex_remcos_smoke-loader_stop

File Explorer

2026-10-02_bb44f6ba42db0c35bbfcb6ee81e6fb27_amadey_dharma_elex_remcos_smoke-loader_stop

.exe 391KB

2026-10-02_bb44f6ba42db0c35bbfcb6ee81e6fb27_amadey_dharma_elex_remcos_smoke-loader_stop

IMPHASH f45c153f3685ff1589f4d956293dc155
SHA256 6b16b26d373b9477461dc7feb8464b684cab80682ba3a1da1e0d9629ff2e5d5d
MD5 bb44f6ba42db0c35bbfcb6ee81e6fb27
SHA1 b8ddb86ab421b6c0640afe23c248b8bc015b3afc
SHA512 d83be36d148fa7a8725c2216402f74fc46185883c83323fb51b251b6cad7bb88a91b582ed71260fe236ba413a012b7ff81c0d73d33a1d1bc1fcaa3bf2b7828b7
SSDEEP 6144:BYxw/CFd33GvegoUSbsiK2t8VlpIftMqTDvaGDmIY0oHJhgoGhPQ3rZY:BYyod33Gvego/Ft8kG8OIZoHJhgTPOa
TLSH
T10F84BE20B690C034F5B752F44AB69328B92F7AA1A73451CF52E416EE57387E5EC3270B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

54336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\kocixesuso.pdb

kernel32

lstrcatA FindFirstChangeNotificationW GetNamedPipeHandleStateW CreateIoCompletionPort FillConsoleOutputCharacterA DisableThreadLibraryCalls TerminateProcess GetProcessId GetVersionExA EnumDateFormatsW FindNextFileW CopyFileExA BuildCommDCBAndTimeoutsA VirtualUnlock WriteProfileStringA VerifyVersionInfoW SetProcessPriorityBoost GetDriveTypeW SetPriorityClass GetCompressedFileSizeA FindNextVolumeMountPointA OutputDebugStringA ResetWriteWatch WriteConsoleInputA WriteConsoleInputW GetConsoleTitleA SetComputerNameExW GetTimeZoneInformation LoadLibraryA GetSystemDirectoryA GetDriveTypeA GetShortPathNameW ActivateActCtx GetProfileSectionA DeleteFileW GetCommandLineW InterlockedExchangeAdd AddRefActCtx FindResourceW FormatMessageA GetModuleFileNameW CreateJobObjectA InitializeCriticalSection SetFirmwareEnvironmentVariableW GetDllDirectoryA GetExitCodeThread WritePrivateProfileStringW GetConsoleAliasesLengthW WriteProfileSectionW AddAtomW UpdateResourceW InterlockedDecrement HeapSize _hwrite InterlockedExchange GetStartupInfoW DisconnectNamedPipe GetCPInfoExW GetSystemWow64DirectoryW SetLastError GetConsoleAliasExesA DebugBreak EndUpdateResourceW GetLastError GetStringTypeW GetConsoleAliasesLengthA DeleteVolumeMountPointA OpenFileMappingA SetDefaultCommConfigA VirtualAlloc GetACP GetConsoleAliasA _lwrite GetQueuedCompletionStatus GetNamedPipeHandleStateA GetDiskFreeSpaceExA AddVectoredExceptionHandler WriteConsoleA VirtualProtect ReadConsoleOutputA GetThreadContext BuildCommDCBA ReleaseActCtx GetHandleInformation GetComputerNameA WritePrivateProfileSectionW TryEnterCriticalSection GetPrivateProfileSectionNamesA OpenWaitableTimerA CopyFileW MoveFileW GetVolumePathNameA SetConsoleMode HeapWalk SetComputerNameA FindNextFileA SetEvent UnlockFileEx GetProcAddress DeleteTimerQueueTimer MoveFileA GlobalAlloc SetCommMask SetFileShortNameA FreeEnvironmentStringsW FindActCtxSectionStringW GetSystemWindowsDirectoryA GetProfileStringW GlobalGetAtomNameA SetComputerNameW GetConsoleAliasesA CreateMailslotA GetConsoleOutputCP MoveFileWithProgressA GetFileInformationByHandle SetLocalTime FoldStringA CallNamedPipeA GetConsoleAliasExesLengthW FindActCtxSectionStringA OpenSemaphoreW GetModuleHandleExA AddAtomA LoadLibraryW WriteConsoleOutputCharacterA GetFileAttributesA GetTickCount LocalUnlock GetFileTime EnumResourceNamesW OpenFileMappingW GetFileType RaiseException ReadConsoleA InterlockedIncrement Sleep DeleteCriticalSection EnterCriticalSection LeaveCriticalSection RtlUnwind DeleteFileA HeapValidate IsBadReadPtr UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsDebuggerPresent GetModuleHandleA TlsGetValue GetModuleHandleW TlsAlloc TlsSetValue GetCurrentThreadId TlsFree GetOEMCP GetCPInfo IsValidCodePage SetHandleCount GetStdHandle GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime ExitProcess GetEnvironmentStringsW HeapDestroy HeapCreate HeapFree VirtualFree GetModuleFileNameA WriteFile HeapAlloc HeapReAlloc FlushFileBuffers WideCharToMultiByte GetConsoleCP GetConsoleMode WriteConsoleW OutputDebugStringW InitializeCriticalSectionAndSpinCount MultiByteToWideChar GetStringTypeA GetLocaleInfoA LCMapStringA LCMapStringW SetFilePointer SetStdHandle ReadFile CloseHandle CreateFileA

user32

CharUpperA

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_bb44f6ba42db0c35bbfcb6ee81e6fb27_amadey_dharma_elex_remcos_smoke-loader_stop

kernel32

user32

generic