2026-11-02_b0e609ca29db411f61a993604e0a435e_amadey_elex_remcos_smoke-loader

General

Target
2026-11-02_b0e609ca29db411f61a993604e0a435e_amadey_elex_remcos_smoke-loader
Size 413KB
Sample261103-bs8q8s1x2l
SHA256 bf31622b8d39a44fe52e9487e186779e170898f185ac1c90fba02d7a27d39a8a
MD5 b0e609ca29db411f61a993604e0a435e
SHA1 8a9d03d70e1b32441681f6ce9b9e4ea00e530a9d
SHA512 5565c189909f5c0ce1da2ce213389e9c057ca77398fed223f3f92a15d579c188b20aa451ca7117775b055d4782e0ac4adaac1d32055e799e729566467008e63b
SSDEEP 6144:O75XQdc3aSalj7jz1EKPfL9uPIKoQrzVVKK4ZVT:OdXQdcfaJVE00PIKoQrLKK
TLSH
T10594AD107BA0C035F5B716B459B993B8B93F7DB1AB2490CF62D52AEA56346E0DC3070B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-02_b0e609ca29db411f61a993604e0a435e_amadey_elex_remcos_smoke-loader

File Explorer

2026-11-02_b0e609ca29db411f61a993604e0a435e_amadey_elex_remcos_smoke-loader

.exe 413KB

2026-11-02_b0e609ca29db411f61a993604e0a435e_amadey_elex_remcos_smoke-loader

IMPHASH 55ae6049290b1a231db6697392c2b841
SHA256 bf31622b8d39a44fe52e9487e186779e170898f185ac1c90fba02d7a27d39a8a
MD5 b0e609ca29db411f61a993604e0a435e
SHA1 8a9d03d70e1b32441681f6ce9b9e4ea00e530a9d
SHA512 5565c189909f5c0ce1da2ce213389e9c057ca77398fed223f3f92a15d579c188b20aa451ca7117775b055d4782e0ac4adaac1d32055e799e729566467008e63b
SSDEEP 6144:O75XQdc3aSalj7jz1EKPfL9uPIKoQrzVVKK4ZVT:OdXQdcfaJVE00PIKoQrLKK
TLSH
T10594AD107BA0C035F5B716B459B993B8B93F7DB1AB2490CF62D52AEA56346E0DC3070B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

85:0a:d7:17:93:a9:a5:91:57:e3:10:74:1b:c8:ae:c5:71:15:45:2a:81:97:66:ef:62:f5:76:6f:e6:30:0a:eb

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Ashampoo GmbH & Co. KG,O=Ashampoo GmbH & Co. KG,L=Rastede,ST=Niedersachsen,C=DE

Chains

Jul 14, 2020

CN=Ashampoo GmbH & Co. KG,O=Ashampoo GmbH & Co. KG,L=Rastede,ST=Niedersachsen,C=DE

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Ashampoo GmbH & Co. KG,O=Ashampoo GmbH & Co. KG,L=Rastede,ST=Niedersachsen,C=DE

Serial Number

0c:b5:19:da:ab:4d:05:0f:a4:68:6a:65:da:4a:e0:3f

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2020 - Apr 11, 2023

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

1

Major OS version

5

Entry point

174560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\nuzaw\fuyizup\bakupaj\hudo10 baje\v.pdb

kernel32

GetFullPathNameA LocalUnlock GetPrivateProfileSectionNamesW EnumResourceNamesW SetCriticalSectionSpinCount GlobalMemoryStatus FindResourceA FindFirstFileW SetThreadContext FindFirstChangeNotificationW EnumCalendarInfoA WriteConsoleInputW SetFilePointer IsBadStringPtrW EnumDateFormatsExW CopyFileExW TlsGetValue GetStringTypeA UnmapViewOfFile MoveFileExA CommConfigDialogA GetConsoleAliasExesLengthA BuildCommDCBAndTimeoutsA DeleteVolumeMountPointA SetUnhandledExceptionFilter MoveFileExW InterlockedDecrement GetCurrentProcess SetDefaultCommConfigW SetFirmwareEnvironmentVariableA QueryDosDeviceA GlobalLock SetVolumeMountPointW GetComputerNameW SetEvent SetThreadExecutionState OpenSemaphoreA GetFileAttributesExA FreeEnvironmentStringsA _lclose GetModuleHandleW GetCommConfig GetProcessHeap IsBadReadPtr GetSystemTimeAsFileTime GetNumberFormatA GetPrivateProfileStringW GetConsoleTitleA CreateRemoteThread GetCompressedFileSizeW ReadConsoleOutputA WaitNamedPipeW EnumTimeFormatsA SetCommState GetSystemWow64DirectoryA WriteFileGather TzSpecificLocalTimeToSystemTime TlsSetValue AllocateUserPhysicalPages FindResourceExA LoadLibraryW GetConsoleMode FatalAppExitW GetThreadSelectorEntry CopyFileW GetPrivateProfileStructW GetCalendarInfoW GetCalendarInfoA SetSystemTimeAdjustment GetProcessHandleCount GetSystemWindowsDirectoryA GetVersionExW SetConsoleCP LeaveCriticalSection GetFileAttributesA lstrcpynW SetDllDirectoryA SetConsoleMode HeapValidate GetVolumePathNamesForVolumeNameW CreateSemaphoreA SetConsoleCursorPosition WritePrivateProfileSectionW TerminateProcess IsDBCSLeadByte GetModuleFileNameW CreateActCtxA GetComputerNameA lstrcmpW lstrlenW WritePrivateProfileStringW VirtualUnlock CreateJobObjectA GetNamedPipeHandleStateW EnumSystemLocalesA GetPrivateProfileIntW VerifyVersionInfoW InterlockedExchange FindFirstFileA OpenMutexW GetLastError ChangeTimerQueueTimer GetLongPathNameW SetLastError ReadConsoleOutputCharacterA GetProcAddress HeapSize PeekConsoleInputW BackupWrite CreateNamedPipeA EnumDateFormatsExA CreateJobSet SetStdHandle EnterCriticalSection VerLanguageNameW SearchPathA BuildCommDCBW DefineDosDeviceA GetNumaHighestNodeNumber GetPrivateProfileStringA GetAtomNameA LoadLibraryA Process32FirstW OpenMutexA CreateSemaphoreW ProcessIdToSessionId LocalAlloc CreateHardLinkW IsSystemResumeAutomatic GetExitCodeThread SetCurrentDirectoryW SetFileApisToANSI PostQueuedCompletionStatus GetCurrentConsoleFont HeapWalk GetPrivateProfileStructA SetNamedPipeHandleState SetEnvironmentVariableA GetModuleFileNameA GetDefaultCommConfigA WriteProfileStringA EnumDateFormatsA CreateIoCompletionPort WaitCommEvent SetConsoleTitleW FindFirstChangeNotificationA GetProcessShutdownParameters QueueUserWorkItem ContinueDebugEvent lstrcatW HeapSetInformation FreeEnvironmentStringsW FindNextFileW WriteProfileStringW VirtualProtect EnumDateFormatsW CompareStringA WriteConsoleOutputAttribute OutputDebugStringA DuplicateHandle FindFirstVolumeA TerminateJobObject CloseHandle DeleteTimerQueueTimer GlobalAddAtomW SetFileValidData GetTempPathA FindActCtxSectionStringW ResetWriteWatch UnregisterWaitEx InterlockedPushEntrySList TlsFree CopyFileExA DeleteFileA lstrcpyA GetBinaryTypeW ExitProcess MoveFileA GetCommandLineW GetStartupInfoW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection DecodePointer UnhandledExceptionFilter IsDebuggerPresent EncodePointer QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId InterlockedIncrement GetEnvironmentStringsW TlsAlloc HeapCreate WriteFile WideCharToMultiByte GetConsoleCP WriteConsoleW OutputDebugStringW RtlUnwind MultiByteToWideChar GetACP GetOEMCP GetCPInfo IsValidCodePage HeapAlloc HeapReAlloc HeapQueryInformation HeapFree FlushFileBuffers IsProcessorFeaturePresent GetStringTypeW LCMapStringW ReadFile CreateFileW RaiseException

advapi32

GetFileSecurityA

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_b0e609ca29db411f61a993604e0a435e_amadey_elex_remcos_smoke-loader

PE Signature issue

kernel32

advapi32

generic