2026-10-11_810c7e131ead168cf7d919c041824c2c_amadey_elex_remcos_silence_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_810c7e131ead168cf7d919c041824c2c_amadey_elex_remcos_silence_smoke-loader
Size 730KB
Sample261012-v4d6jsec75
SHA256 2efc033daa98b250aa3ca5d8ecefd2f6342321fa33f90e2a8c15b7731e9cc84f
MD5 810c7e131ead168cf7d919c041824c2c
SHA1 dffb5c2f77144748f16b5341c4ed08e97f9653ba
SHA512 25214c73479543a16c0fddd6b71a7804f397b9580350a4962c430a2b0704c332c8318293a3def75677ff80b7c9a5e068cb75177c79f24e4b747f6cd1235a1b3f
SSDEEP 6144:YRsLzKDBS9X//ZumAXbAS/KZKNU5AOKAOKucJ0QFhmxTB7drI/7gkzKTr6gQu10w:cyzKDBMEXXb1RNU5QQ/Kv6gQui69
TLSH
T106F49E127AC2C170E47141B01FB98B174579BD368B6649EBB7D8BE1E0C706D2173AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-11_810c7e131ead168cf7d919c041824c2c_amadey_elex_remcos_silence_smoke-loader

File Explorer

2026-10-11_810c7e131ead168cf7d919c041824c2c_amadey_elex_remcos_silence_smoke-loader

.exe 730KB

2026-10-11_810c7e131ead168cf7d919c041824c2c_amadey_elex_remcos_silence_smoke-loader

IMPHASH 4de8c21a4c2232ab112a1f5c9baa99e0
SHA256 2efc033daa98b250aa3ca5d8ecefd2f6342321fa33f90e2a8c15b7731e9cc84f
MD5 810c7e131ead168cf7d919c041824c2c
SHA1 dffb5c2f77144748f16b5341c4ed08e97f9653ba
SHA512 25214c73479543a16c0fddd6b71a7804f397b9580350a4962c430a2b0704c332c8318293a3def75677ff80b7c9a5e068cb75177c79f24e4b747f6cd1235a1b3f
SSDEEP 6144:YRsLzKDBS9X//ZumAXbAS/KZKNU5AOKAOKucJ0QFhmxTB7drI/7gkzKTr6gQu10w:cyzKDBMEXXb1RNU5QQ/Kv6gQui69
TLSH
T106F49E127AC2C170E47141B01FB98B174579BD368B6649EBB7D8BE1E0C706D2173AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

30:9c:c7:45:21:c2:58:b9:6a:22:99:25:d3:ea:45:d6:d9:85:53:46

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Advanced Micro Devices\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Advanced Micro Devices\, Inc.,L=Sunnyvale,ST=California,C=US

Chains

Jun 12, 2014

CN=Advanced Micro Devices\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Advanced Micro Devices\, Inc.,L=Sunnyvale,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Advanced Micro Devices\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Advanced Micro Devices\, Inc.,L=Sunnyvale,ST=California,C=US

Serial Number

4c:d9:e7:55:85:0c:13:72:b4:8d:c1:82:a7:30:8b:ab

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 3, 2013 - Jun 1, 2016

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

177140

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\workarea\13.351.1007.1006\apps\ccc2\Source\Utilities\CliStart\build\x86\B_rel\CLIStart.pdb

psapi

EnumProcesses

kernel32

CreateEventA SetEvent GetTickCount GlobalAddAtomA GlobalDeleteAtom SetLastError FindFirstFileW GetLocaleInfoW LoadLibraryW GetACP ReadConsoleW ReadFile FlushFileBuffers WriteConsoleW SetStdHandle GetTimeZoneInformation SetFilePointerEx GetConsoleMode GetLastError GetStringTypeW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW HeapReAlloc RtlUnwind OutputDebugStringW LoadLibraryExW LeaveCriticalSection EnterCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW CreateProcessW GetTickCount64 CloseHandle QueryFullProcessImageNameA OpenProcess GetVersionExA Sleep OutputDebugStringA FreeLibrary GetProcAddress LoadLibraryA CreateFileW GetConsoleCP EncodePointer GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetModuleFileNameA DeleteCriticalSection GetFileType GetModuleHandleW GetStartupInfoW HeapAlloc HeapFree SetEnvironmentVariableA DecodePointer IsDebuggerPresent IsProcessorFeaturePresent WideCharToMultiByte MultiByteToWideChar FindFirstFileExW FindClose SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetCommandLineA InterlockedDecrement ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW GetProcessHeap RaiseException InterlockedIncrement GetCurrentThreadId HeapSize IsValidCodePage GetOEMCP GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfA SetTimer LoadStringW DestroyMenu TrackPopupMenu SetMenuDefaultItem InsertMenuW GetCursorPos CreatePopupMenu SetForegroundWindow LoadImageW UnregisterHotKey RegisterHotKey CreateWindowExA RegisterClassExA LoadCursorA LoadIconA DefWindowProcA SendMessageA PostQuitMessage IsWindow FindWindowW MessageBoxExA DestroyWindow KillTimer DispatchMessageA GetMessageA

advapi32

RegSetValueExW RegDeleteValueW RegQueryInfoKeyW RegCreateKeyExW RegEnumValueW RegQueryValueExW RegOpenKeyExA RegCloseKey RegQueryValueExA RegOpenKeyExW RegSetValueExA RegCreateKeyExA RegEnumKeyExW

shell32

SHGetSpecialFolderLocation SHBindToParent Shell_NotifyIconW SHGetMalloc

ole32

CoInitialize CoUninitialize CoCreateInstance

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_810c7e131ead168cf7d919c041824c2c_amadey_elex_remcos_silence_smoke-loader

PE Signature issue

psapi

kernel32

user32

advapi32

shell32

ole32

generic