2026-10-31_711dd6d1416988c5950efabd75a5ad01_amadey_conti_elex_remcos

General

Target
2026-10-31_711dd6d1416988c5950efabd75a5ad01_amadey_conti_elex_remcos
Size 150KB
Sample261102-alaeesy1ev
SHA256 ae0a4a127760988a84317e6bdb63c01fd58351ad028005a1499e2f492cf9fb97
MD5 711dd6d1416988c5950efabd75a5ad01
SHA1 47e54f37c6dbc8efdc3fcbb3edddeb046f1f4e9c
SHA512 5f2a7bb793b7a4ac74cca9f992c191d61cad6d3317b9d31b6b053d85a5ebcbf7ffcbe9db2939418f57d6b4a0e656362155e154add49903818678946dd29a2488
SSDEEP 3072:UAt2Sb2m5oyiTOZQvfSERdX9Zk8ACB+6lbAZToEE6ooqiq8EpKP1dwLFurHNIN3:fxwjRjB+Nd1E6dqi4py5IR
TLSH
T1C0E35C03719280F4D176853049FB8A715A7B7C310A245FAF67D4EA390F70B91AE36F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_711dd6d1416988c5950efabd75a5ad01_amadey_conti_elex_remcos

File Explorer

2026-10-31_711dd6d1416988c5950efabd75a5ad01_amadey_conti_elex_remcos

.exe 150KB

2026-10-31_711dd6d1416988c5950efabd75a5ad01_amadey_conti_elex_remcos

IMPHASH 7df1816239c5bc855600d41210406c5b
SHA256 ae0a4a127760988a84317e6bdb63c01fd58351ad028005a1499e2f492cf9fb97
MD5 711dd6d1416988c5950efabd75a5ad01
SHA1 47e54f37c6dbc8efdc3fcbb3edddeb046f1f4e9c
SHA512 5f2a7bb793b7a4ac74cca9f992c191d61cad6d3317b9d31b6b053d85a5ebcbf7ffcbe9db2939418f57d6b4a0e656362155e154add49903818678946dd29a2488
SSDEEP 3072:UAt2Sb2m5oyiTOZQvfSERdX9Zk8ACB+6lbAZToEE6ooqiq8EpKP1dwLFurHNIN3:fxwjRjB+Nd1E6dqi4py5IR
TLSH
T1C0E35C03719280F4D176853049FB8A715A7B7C310A245FAF67D4EA390F70B91AE36F6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

29762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleUpdate_unsigned.pdb

advapi32

RegOpenKeyExW

kernel32

SizeofResource HeapFree GetCommandLineW GetModuleFileNameW InitializeCriticalSectionAndSpinCount HeapSize GetLastError GetFileAttributesExW LockResource HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy GetProcAddress DeleteCriticalSection GetProcessHeap GetModuleHandleW FreeLibrary LoadLibraryExW WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW SetStdHandle CloseHandle IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetStdHandle WriteFile GetACP LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType CreateFileW

shell32

SHGetFolderPathW

user32

CharLowerBuffW

shlwapi

SHQueryValueExW PathAppendW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_711dd6d1416988c5950efabd75a5ad01_amadey_conti_elex_remcos

advapi32

kernel32

shell32

user32

shlwapi

generic