2026-10-30_5052cbc39c635f0314d6ef18a5d70f21_amadey_elex_remcos_smoke-loader

General

Target
2026-10-30_5052cbc39c635f0314d6ef18a5d70f21_amadey_elex_remcos_smoke-loader
Size 12.6MB
Sample261101-c8bxwastd1
SHA256 972c88a27400bcd329cd4d37501e86533aa5e83bbf439a17ab5459a570c55c28
MD5 5052cbc39c635f0314d6ef18a5d70f21
SHA1 5cf78af5bdfdcbe24a60d1d29004ee5ea064f681
SHA512 0a08023f90a9289f3bdb28abae1cae965c9a8326edb3265b2090da240573e515c4c04a13b2ce795ce2009aa2c0efeea35aea8ef4b4a04359224ff53c35f950a2
SSDEEP 49152:cIm2s0vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvf:cIm2s
TLSH
T182D68DB484F2CD97C5FA08BC6FAD7F5649ECA2F3D60496B38AD624E560321F094D610B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_5052cbc39c635f0314d6ef18a5d70f21_amadey_elex_remcos_smoke-loader

File Explorer

2026-10-30_5052cbc39c635f0314d6ef18a5d70f21_amadey_elex_remcos_smoke-loader

.exe 12.6MB

2026-10-30_5052cbc39c635f0314d6ef18a5d70f21_amadey_elex_remcos_smoke-loader

IMPHASH ba8fb4919796ba15ef3c17ab1a11e5fc
SHA256 972c88a27400bcd329cd4d37501e86533aa5e83bbf439a17ab5459a570c55c28
MD5 5052cbc39c635f0314d6ef18a5d70f21
SHA1 5cf78af5bdfdcbe24a60d1d29004ee5ea064f681
SHA512 0a08023f90a9289f3bdb28abae1cae965c9a8326edb3265b2090da240573e515c4c04a13b2ce795ce2009aa2c0efeea35aea8ef4b4a04359224ff53c35f950a2
SSDEEP 49152:cIm2s0vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvf:cIm2s
TLSH
T182D68DB484F2CD97C5FA08BC6FAD7F5649ECA2F3D60496B38AD624E560321F094D610B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

117040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\tucowe-dokuz-wamobabu\19\fibili.pdb

kernel32

TlsGetValue GetCPInfo ReadConsoleA InterlockedDecrement GetSystemWindowsDirectoryW HeapFree SetHandleInformation GetProfileSectionA SetVolumeMountPointW UnlockFile BackupSeek FreeEnvironmentStringsA GetModuleHandleW IsBadReadPtr GetConsoleAliasesLengthA GetPrivateProfileStringW GetDriveTypeA ActivateActCtx GlobalAlloc GetPrivateProfileIntA GetSystemWow64DirectoryW GetVersionExW SetDllDirectoryA SetConsoleMode SetConsoleCursorPosition VerifyVersionInfoA IsDBCSLeadByte GetSystemDirectoryA CreateActCtxA CompareStringW GetStartupInfoW WritePrivateProfileStringW GetNamedPipeHandleStateW FindFirstFileExA GetLastError SetLastError GetProcAddress WriteProfileSectionA GlobalGetAtomNameA BuildCommDCBW OpenWaitableTimerW SetFileApisToANSI QueryDosDeviceW SetSystemTime SetEnvironmentVariableA GetModuleFileNameA SetConsoleCursorInfo FindFirstChangeNotificationA GetCurrentDirectoryA CompareStringA GetFileTime SetProcessShutdownParameters SetFileShortNameA ReadConsoleInputW GetWindowsDirectoryW DeleteFileW LocalFileTimeToFileTime CloseHandle SetStdHandle FlushFileBuffers LCMapStringW MoveFileA GetCommandLineW HeapSetInformation IsProcessorFeaturePresent EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime InterlockedIncrement ExitProcess FreeEnvironmentStringsW GetEnvironmentStringsW HeapValidate TlsAlloc TlsSetValue TlsFree HeapCreate WriteFile RaiseException RtlUnwind GetACP GetOEMCP IsValidCodePage SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW HeapAlloc HeapReAlloc HeapSize HeapQueryInformation GetStringTypeW MultiByteToWideChar CreateFileW

user32

GetCursorInfo GetMessagePos

winhttp

WinHttpCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_5052cbc39c635f0314d6ef18a5d70f21_amadey_elex_remcos_smoke-loader

kernel32

user32

winhttp

generic