2026-11-03_f9297f57e7432c4de89cb791e9083c34_amadey_elex_remcos_smoke-loader

General

Target
2026-11-03_f9297f57e7432c4de89cb791e9083c34_amadey_elex_remcos_smoke-loader
Size 12.6MB
Sample261104-cac3aacb52
SHA256 9e28ad096644f303885a42fa9393ef0666dc2d36935cb85c4fee62eb9fcb2e7b
MD5 f9297f57e7432c4de89cb791e9083c34
SHA1 9a8bd43e3b90bd71c0632688f10db388b531ea5a
SHA512 50f54d97bbbde93db7fc907a4f6202b7b33635354018de25252802c5b9d08e43c1c95a82eb527cd614d0b08f654bc2a6ff79a14241534cd460a2fd6e0c6bd718
SSDEEP 24576:8Swf8lsd83RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRB:Pwk
TLSH
T1E3D68C211AB84D2CC4F549FD732D3F1189FEC770EBD1A6A7A90828F548B75BA24D2427
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_f9297f57e7432c4de89cb791e9083c34_amadey_elex_remcos_smoke-loader

File Explorer

2026-11-03_f9297f57e7432c4de89cb791e9083c34_amadey_elex_remcos_smoke-loader

.exe 12.6MB

2026-11-03_f9297f57e7432c4de89cb791e9083c34_amadey_elex_remcos_smoke-loader

IMPHASH 9aeb2463a45e44e4b568bf1d36aa5947
SHA256 9e28ad096644f303885a42fa9393ef0666dc2d36935cb85c4fee62eb9fcb2e7b
MD5 f9297f57e7432c4de89cb791e9083c34
SHA1 9a8bd43e3b90bd71c0632688f10db388b531ea5a
SHA512 50f54d97bbbde93db7fc907a4f6202b7b33635354018de25252802c5b9d08e43c1c95a82eb527cd614d0b08f654bc2a6ff79a14241534cd460a2fd6e0c6bd718
SSDEEP 24576:8Swf8lsd83RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRB:Pwk
TLSH
T1E3D68C211AB84D2CC4F549FD732D3F1189FEC770EBD1A6A7A90828F548B75BA24D2427
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

110256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\manacan\puvu.pdb

kernel32

ExitProcess GetComputerNameA SetInformationJobObject FindFirstChangeNotificationW lstrlenA CopyFileExW TlsGetValue SetLocalTime CommConfigDialogA FreeLibrary SetDllDirectoryW InterlockedIncrement InterlockedDecrement ZombifyActCtx SetFirmwareEnvironmentVariableA SetEnvironmentVariableW GetNamedPipeHandleStateA SetVolumeMountPointW OpenSemaphoreA OutputDebugStringW GetTickCount GetProcessHeap GetConsoleAliasesLengthA GetConsoleTitleA ReadConsoleW CreateRemoteThread CreateActCtxW TlsSetValue GetConsoleCP GetPrivateProfileIntA LoadLibraryW GetConsoleMode TerminateThread CopyFileW GetCalendarInfoA LeaveCriticalSection GlobalFlags HeapValidate CreateSemaphoreA GetModuleFileNameW CompareStringW CreateJobObjectA VerifyVersionInfoW SetCurrentDirectoryA FindFirstFileA GetLastError GetProcAddress GetLongPathNameA HeapSize BackupWrite VerLanguageNameA CreateNamedPipeA SearchPathA GetNumaHighestNodeNumber GetPrivateProfileStringA LoadLibraryA ProcessIdToSessionId LocalAlloc GetFileType WritePrivateProfileStringA BuildCommDCBAndTimeoutsW GetVolumePathNamesForVolumeNameA GetModuleFileNameA FindNextFileA WriteProfileStringA GetModuleHandleA FindFirstChangeNotificationA GetProcessShutdownParameters FreeEnvironmentStringsW WriteProfileStringW BuildCommDCBA GetConsoleCursorInfo FindFirstVolumeA GetVersionExA TlsAlloc ReadConsoleOutputCharacterW GetSystemTime TlsFree GetProfileSectionW EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsBadReadPtr IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetLastError HeapCreate WriteFile SetFilePointer WideCharToMultiByte EnterCriticalSection GetACP GetOEMCP GetCPInfo IsValidCodePage OutputDebugStringA WriteConsoleW HeapAlloc HeapReAlloc HeapQueryInformation HeapFree RtlUnwind SetStdHandle MultiByteToWideChar GetStringTypeW LCMapStringW RaiseException CreateFileW CloseHandle FlushFileBuffers

Name

.text

Size

235KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

39.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wuhaz

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xic

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ragejuh

Size

512B

Virtual Size

234B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12.4MB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_f9297f57e7432c4de89cb791e9083c34_amadey_elex_remcos_smoke-loader

kernel32

generic