2026-10-30_7a6f5bb520d817a77a238518e375a5da_amadey_elex_remcos_smoke-loader

General

Target
2026-10-30_7a6f5bb520d817a77a238518e375a5da_amadey_elex_remcos_smoke-loader
Size 12.2MB
Sample261101-akpsqag16m
SHA256 29fe6eea69f112bbb4aa9cfbd68b59bdc22ca6c647524ee47bdcfb67e24c5778
MD5 7a6f5bb520d817a77a238518e375a5da
SHA1 1bf7277d2dc9791a48786f425811ffc4083916f8
SHA512 7eb625089cf259d1aa71ddbacb1940afee26ea36a57b42b842ca9babf9fef4c8a3bf7803370cb22e507dbda99d4e142bca7ecd62d490bd5a1bcc8221e439ded4
SSDEEP 98304:F+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaX:
TLSH
T1B7D66B25DA7316B3D06549BDA26C3FBDDBFE83B0D3105437504868F898233AB29E5687
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_7a6f5bb520d817a77a238518e375a5da_amadey_elex_remcos_smoke-loader

File Explorer

2026-10-30_7a6f5bb520d817a77a238518e375a5da_amadey_elex_remcos_smoke-loader

.exe 12.2MB

2026-10-30_7a6f5bb520d817a77a238518e375a5da_amadey_elex_remcos_smoke-loader

IMPHASH 9e4746628ebaf71569a51552a1011d76
SHA256 29fe6eea69f112bbb4aa9cfbd68b59bdc22ca6c647524ee47bdcfb67e24c5778
MD5 7a6f5bb520d817a77a238518e375a5da
SHA1 1bf7277d2dc9791a48786f425811ffc4083916f8
SHA512 7eb625089cf259d1aa71ddbacb1940afee26ea36a57b42b842ca9babf9fef4c8a3bf7803370cb22e507dbda99d4e142bca7ecd62d490bd5a1bcc8221e439ded4
SSDEEP 98304:F+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaX:
TLSH
T1B7D66B25DA7316B3D06549BDA26C3FBDDBFE83B0D3105437504868F898233AB29E5687
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

111136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\mici juyuwukepom52 fogoyujeno73\lahegay.pdb

kernel32

GetConsoleAliasesLengthW TlsGetValue SetDllDirectoryW InterlockedIncrement GetProfileSectionA SetConsoleScreenBufferSize SetVolumeMountPointW FreeEnvironmentStringsA IsBadReadPtr GetSystemTimeAsFileTime GetPrivateProfileStringW ReadConsoleW GetSystemWow64DirectoryA CreateActCtxW ActivateActCtx GlobalAlloc GetSystemDirectoryW SetFileShortNameW ReadConsoleInputA CopyFileW GetSystemWindowsDirectoryA SetConsoleMode HeapValidate GetModuleFileNameW CompareStringW GetACP GetStartupInfoW WritePrivateProfileStringW GetNamedPipeHandleStateW VerifyVersionInfoW FindFirstFileExA GetHandleInformation GetLastError IsDBCSLeadByteEx GetCurrentDirectoryW SetLastError BackupRead GetProcAddress IsBadHugeWritePtr WriteProfileSectionA IsValidCodePage GlobalGetAtomNameA BuildCommDCBW LoadLibraryA OpenWaitableTimerW GetModuleFileNameA SetConsoleCursorInfo GetFileTime SetProcessShutdownParameters GetVersionExA GetWindowsDirectoryW DeleteFileW TlsFree LocalFileTimeToFileTime CloseHandle ReadFile MoveFileA DeleteFileA GetCommandLineW HeapSetInformation EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection DecodePointer TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer IsProcessorFeaturePresent QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId InterlockedDecrement GetModuleHandleW ExitProcess FreeEnvironmentStringsW GetEnvironmentStringsW TlsAlloc TlsSetValue HeapCreate WriteFile SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW RtlUnwind MultiByteToWideChar GetOEMCP GetCPInfo RaiseException HeapAlloc HeapReAlloc HeapSize HeapQueryInformation HeapFree FlushFileBuffers SetStdHandle GetStringTypeW LCMapStringW CreateFileW

user32

GetCursorInfo GetMenuInfo GetMessageTime

winhttp

WinHttpCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_7a6f5bb520d817a77a238518e375a5da_amadey_elex_remcos_smoke-loader

kernel32

user32

winhttp

generic