2026-10-31_a7ba5a4f17af6d28bcc67a7d0c08bc85_amadey_elex_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_a7ba5a4f17af6d28bcc67a7d0c08bc85_amadey_elex_remcos_smoke-loader
Size 396KB
Sample261101-1pc8laft5m
SHA256 39e73b3665453af8ed3e287bfb786586a4659fdf7da7250035d8b2846e82181b
MD5 a7ba5a4f17af6d28bcc67a7d0c08bc85
SHA1 c4902476bdd4d4c8552f5825519d69abdc9fccdb
SHA512 7d41b2f845d39ee0266733566a5e824902065415257f9dff1ae29aa2694519121e461ce3aa93e3bb089a7a09260cf329f3d96607b896656102a8aad6785f31da
SSDEEP 6144:zol1MFXz+s8WgBRmiQU8t05ShXMtr8oIo5TWmOIXJEtWUPUsLhKArCz0:aGjeRBQiQBtoUXMJftX5EtWUPrKA
TLSH
T1FA84C0146BA0C034F2B716F89AB593B5AA3F7DA16B3890CF52D526EA56347D0EC70307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_a7ba5a4f17af6d28bcc67a7d0c08bc85_amadey_elex_remcos_smoke-loader

File Explorer

2026-10-31_a7ba5a4f17af6d28bcc67a7d0c08bc85_amadey_elex_remcos_smoke-loader

.exe 396KB

2026-10-31_a7ba5a4f17af6d28bcc67a7d0c08bc85_amadey_elex_remcos_smoke-loader

IMPHASH b90a6995421b6eb79d6bcd36b44f24cf
SHA256 39e73b3665453af8ed3e287bfb786586a4659fdf7da7250035d8b2846e82181b
MD5 a7ba5a4f17af6d28bcc67a7d0c08bc85
SHA1 c4902476bdd4d4c8552f5825519d69abdc9fccdb
SHA512 7d41b2f845d39ee0266733566a5e824902065415257f9dff1ae29aa2694519121e461ce3aa93e3bb089a7a09260cf329f3d96607b896656102a8aad6785f31da
SSDEEP 6144:zol1MFXz+s8WgBRmiQU8t05ShXMtr8oIo5TWmOIXJEtWUPUsLhKArCz0:aGjeRBQiQBtoUXMJftX5EtWUPrKA
TLSH
T1FA84C0146BA0C034F2B716F89AB593B5AA3F7DA16B3890CF52D526EA56347D0EC70307
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

209024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\piruzub\mahefatama_fakicezo 39_k.pdb

kernel32

GetPrivateProfileSectionNamesW EnumResourceNamesW UnregisterWait GetNumaNodeProcessorMask SetCriticalSectionSpinCount SearchPathW SetInformationJobObject lstrcmpA FindFirstFileW SetThreadContext EnumCalendarInfoA WriteConsoleInputW IsBadStringPtrW lstrlenA GetConsoleAliasesLengthW EnumDateFormatsExW CopyFileExW TlsGetValue SetLocalTime UnmapViewOfFile MoveFileExA CommConfigDialogA GetNumberOfConsoleInputEvents GetConsoleAliasExesLengthA SetErrorMode FindResourceW FreeLibrary DeleteVolumeMountPointA SetUnhandledExceptionFilter LoadLibraryExW SetDllDirectoryW InterlockedIncrement GetQueuedCompletionStatus VerSetConditionMask MoveFileExW InterlockedDecrement WaitNamedPipeA SetMailslotInfo ZombifyActCtx SetConsoleActiveScreenBuffer WritePrivateProfileSectionA SetDefaultCommConfigW SetFirmwareEnvironmentVariableA SetEnvironmentVariableW GetNamedPipeHandleStateA SignalObjectAndWait AddConsoleAliasW SetVolumeMountPointW GetComputerNameW SetEvent SetThreadExecutionState OpenSemaphoreA GetFileAttributesExA _lclose OutputDebugStringW GetTickCount GetCommConfig GetProcessHeap IsBadReadPtr GetSystemTimeAsFileTime GetPrivateProfileStringW GetConsoleTitleA ReadConsoleW CreateRemoteThread GetCompressedFileSizeW EnumTimeFormatsA SetCommTimeouts CreateActCtxW InitializeCriticalSection GetProcessTimes TlsSetValue AllocateUserPhysicalPages OpenProcess FindResourceExA GetConsoleCP GlobalAlloc GetPrivateProfileIntA LoadLibraryW GetConsoleMode FatalAppExitW GetThreadSelectorEntry AssignProcessToJobObject GetCalendarInfoA ReadFileScatter SetSystemTimeAdjustment ReadConsoleOutputW SetConsoleCP InterlockedPopEntrySList LeaveCriticalSection GetFileAttributesA GlobalFlags lstrcpynW GetNamedPipeInfo HeapValidate GetVolumePathNamesForVolumeNameW CreateSemaphoreA SetConsoleCursorPosition HeapQueryInformation WritePrivateProfileSectionW TerminateProcess GetAtomNameW FileTimeToSystemTime GetThreadContext lstrcatA GetBinaryTypeW CompareStringW ExitThread GetVolumePathNameA lstrlenW SetConsoleTitleA WritePrivateProfileStringW GlobalUnlock VirtualUnlock GetTempPathW GetStringTypeExA CreateJobObjectA GetPrivateProfileIntW VerifyVersionInfoW InterlockedExchange SetCurrentDirectoryA GetStdHandle FindFirstFileA GetLastError ChangeTimerQueueTimer GetLongPathNameW BindIoCompletionCallback GetProcAddress FindVolumeMountPointClose VirtualAlloc HeapSize BackupWrite VerLanguageNameA CreateNamedPipeA CreateJobSet LocalLock LockFileEx BuildCommDCBW DefineDosDeviceA GetNumaHighestNodeNumber FindClose GetPrivateProfileStringA LoadLibraryA Process32FirstW OpenMutexA ProcessIdToSessionId GetFileType MoveFileA BuildCommDCBAndTimeoutsW CreateHardLinkW GetExitCodeThread GetNumberFormatW SetFileApisToANSI QueryDosDeviceW SetConsoleWindowInfo SetThreadIdealProcessor HeapWalk GetPrivateProfileStructA GetTapeParameters GetVolumePathNamesForVolumeNameA GetModuleFileNameA GetDefaultCommConfigA FindNextFileA WriteProfileStringA EnumDateFormatsA WaitCommEvent _lread GetModuleHandleA FindFirstChangeNotificationA GetProcessShutdownParameters QueueUserWorkItem ContinueDebugEvent IsDebuggerPresent GetProcessAffinityMask FreeEnvironmentStringsW EnumResourceNamesA WriteProfileStringW EnumDateFormatsW GetConsoleCursorInfo FatalAppExitA PeekConsoleInputA DeleteCriticalSection WriteConsoleOutputAttribute OutputDebugStringA GetCPInfoExA DuplicateHandle FindFirstVolumeA GetVersionExA ReadConsoleInputW TlsAlloc TerminateJobObject CloseHandle GetVersion DeleteTimerQueueTimer GlobalAddAtomW SetFileValidData FindActCtxSectionStringW ResetWriteWatch UnregisterWaitEx ReadConsoleOutputCharacterW TlsFree GetProfileSectionW EnumSystemLocalesW lstrcpyW CreateFileW SetStdHandle GetComputerNameA GetFullPathNameA GetModuleFileNameW ExitProcess RaiseException GetCommandLineW HeapSetInformation GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId DecodePointer GetModuleHandleW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount EncodePointer SetLastError HeapCreate WriteFile GetACP GetOEMCP GetCPInfo IsValidCodePage EnterCriticalSection GetCurrentProcess UnhandledExceptionFilter HeapAlloc HeapReAlloc HeapFree RtlUnwind WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW WriteConsoleW IsProcessorFeaturePresent SetFilePointer FlushFileBuffers

user32

GetMessageTime

gdi32

GetBitmapBits

advapi32

InitiateSystemShutdownA

msimg32

GradientFill

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_a7ba5a4f17af6d28bcc67a7d0c08bc85_amadey_elex_remcos_smoke-loader

kernel32

user32

gdi32

advapi32

msimg32

generic