2026-11-03_b941a80d828332ba4689cf856222128d_amadey_elex_remcos_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_b941a80d828332ba4689cf856222128d_amadey_elex_remcos_smoke-loader
Size 15.0MB
Sample261104-lp8beazydv
SHA256 4a563a6d75de3775a3c51e949da78c6e5d0afcd9cdf871d08a70ee519a816d06
MD5 b941a80d828332ba4689cf856222128d
SHA1 740d6239179adea02484a105c6027f86b83d7486
SHA512 5d2f83deecb991e0634d0382feb164164ddc0f50abd53a1d9190b4ea10bcbaeb02e27a4b1fce5bbe4aac31423411bf781cf70a33764e71fe6c8266d747a52388
SSDEEP 24576:yMmDJxagM666666666666666666666666666666666666666666666666666666a:yn
TLSH
T18DF68E320CA844B3C0B4857C75AD3765EEED56B2F38D46BF29A016F9A4332B999F1503
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_b941a80d828332ba4689cf856222128d_amadey_elex_remcos_smoke-loader

File Explorer

2026-11-03_b941a80d828332ba4689cf856222128d_amadey_elex_remcos_smoke-loader

.exe 15.0MB

2026-11-03_b941a80d828332ba4689cf856222128d_amadey_elex_remcos_smoke-loader

IMPHASH e4cc0552ff5e56edf2c3c2af90f2cbe3
SHA256 4a563a6d75de3775a3c51e949da78c6e5d0afcd9cdf871d08a70ee519a816d06
MD5 b941a80d828332ba4689cf856222128d
SHA1 740d6239179adea02484a105c6027f86b83d7486
SHA512 5d2f83deecb991e0634d0382feb164164ddc0f50abd53a1d9190b4ea10bcbaeb02e27a4b1fce5bbe4aac31423411bf781cf70a33764e71fe6c8266d747a52388
SSDEEP 24576:yMmDJxagM666666666666666666666666666666666666666666666666666666a:yn
TLSH
T18DF68E320CA844B3C0B4857C75AD3765EEED56B2F38D46BF29A016F9A4332B999F1503
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

111136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\gulab nupibabuh52-ferewolagave\nawofaja kogimi.pdb

kernel32

GetFullPathNameA GetThreadContext GetPrivateProfileSectionNamesW EnumResourceNamesW UnregisterWait GetNumaNodeProcessorMask SetCriticalSectionSpinCount GetCommModemStatus GlobalMemoryStatus SearchPathW SetInformationJobObject lstrcmpA FindFirstFileW SetThreadContext FindFirstChangeNotificationW EnumCalendarInfoA WriteConsoleInputW IsBadStringPtrW lstrlenA GetConsoleAliasesLengthW EnumDateFormatsExW CopyFileExW TlsGetValue SetLocalTime UnmapViewOfFile MoveFileExA GetNumberOfConsoleInputEvents GetConsoleAliasExesLengthA WriteConsoleOutputCharacterA SetErrorMode FindResourceW FreeLibrary DeleteVolumeMountPointA SetUnhandledExceptionFilter LoadLibraryExW SetDllDirectoryW InterlockedIncrement GetQueuedCompletionStatus VerSetConditionMask MoveFileExW InterlockedDecrement WaitNamedPipeA SetMailslotInfo ZombifyActCtx SetConsoleActiveScreenBuffer WritePrivateProfileSectionA SetDefaultCommConfigW SetFirmwareEnvironmentVariableA SetEnvironmentVariableW GetNamedPipeHandleStateA SignalObjectAndWait AddConsoleAliasW SetVolumeMountPointW GetComputerNameW SetEvent SetThreadExecutionState OpenSemaphoreA GetFileAttributesExA _lclose OutputDebugStringW GetTickCount GetCommConfig GetProcessHeap IsBadReadPtr GetConsoleAliasesLengthA GetSystemTimeAsFileTime GetPrivateProfileStringW GetConsoleTitleA ReadConsoleW CreateRemoteThread GetCompressedFileSizeW EnumTimeFormatsA SetCommTimeouts CreateActCtxW InitializeCriticalSection GetProcessTimes TlsSetValue AllocateUserPhysicalPages OpenProcess FindResourceExA GetConsoleCP GetPrivateProfileIntA LoadLibraryW GetConsoleMode TerminateThread FatalAppExitW ReadConsoleInputA GetThreadSelectorEntry CopyFileW AssignProcessToJobObject GetPrivateProfileStructW GetCalendarInfoA ReadFileScatter SetSystemTimeAdjustment ReadConsoleOutputW MapUserPhysicalPagesScatter SetConsoleCP InterlockedPopEntrySList LeaveCriticalSection GlobalFlags lstrcpynW GetNamedPipeInfo HeapValidate GetVolumePathNamesForVolumeNameW CreateSemaphoreA SetConsoleCursorPosition GetFileAttributesW HeapQueryInformation GetBinaryTypeA WritePrivateProfileSectionW GetComputerNameA GetAtomNameW FileTimeToSystemTime GetModuleFileNameW lstrcatA GetBinaryTypeW CompareStringW ExitThread GetVolumePathNameA SetConsoleTitleA GlobalUnlock VirtualUnlock GetTempPathW RaiseException GetStringTypeExA CreateJobObjectA GetPrivateProfileIntW VerifyVersionInfoW InterlockedExchange SetCurrentDirectoryA GetStdHandle FindFirstFileA GetLastError ChangeTimerQueueTimer BindIoCompletionCallback GetProcAddress FindVolumeMountPointClose GetLongPathNameA VirtualAlloc HeapSize BackupWrite VerLanguageNameA CreateNamedPipeA EnumDateFormatsExA CreateJobSet LocalLock MoveFileW LockFileEx SearchPathA DefineDosDeviceA GetNumaHighestNodeNumber FindClose GetPrivateProfileStringA LoadLibraryA Process32FirstW OpenMutexA ProcessIdToSessionId LocalAlloc GetFileType WritePrivateProfileStringA BuildCommDCBAndTimeoutsW CreateHardLinkW GetExitCodeThread GetNumberFormatW SetFileApisToANSI QueryDosDeviceW SetConsoleWindowInfo SetThreadIdealProcessor HeapWalk GetPrivateProfileStructA GetTapeParameters GetVolumePathNamesForVolumeNameA GetModuleFileNameA GetDefaultCommConfigA FindNextFileA WriteProfileStringA EnumDateFormatsA WaitCommEvent _lread GetModuleHandleA GetProcessShutdownParameters QueueUserWorkItem ContinueDebugEvent IsDebuggerPresent GetProcessAffinityMask FreeEnvironmentStringsW EnumResourceNamesA WriteProfileStringW BuildCommDCBA EnumDateFormatsW GetConsoleCursorInfo FatalAppExitA PeekConsoleInputA DeleteCriticalSection WriteConsoleOutputAttribute OutputDebugStringA GetCPInfoExA DuplicateHandle FindFirstVolumeA GetVersionExA TlsAlloc TerminateJobObject CloseHandle FileTimeToLocalFileTime GetVersion QueryDepthSList DeleteTimerQueueTimer GlobalAddAtomW SetFileValidData FindActCtxSectionStringW ResetWriteWatch UnregisterWaitEx ReadConsoleOutputCharacterW TlsFree GetProfileSectionW EnumSystemLocalesW lstrcpyW CommConfigDialogW DeleteFileA TerminateProcess ExitProcess FlushFileBuffers CreateFileW LCMapStringW EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount SetLastError HeapCreate WriteFile SetFilePointer WideCharToMultiByte EnterCriticalSection GetACP GetOEMCP GetCPInfo IsValidCodePage WriteConsoleW HeapAlloc HeapReAlloc HeapFree RtlUnwind SetStdHandle MultiByteToWideChar GetStringTypeW

user32

GetMessageTime

gdi32

GetBitmapBits

winhttp

WinHttpReadData

msimg32

GradientFill

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_b941a80d828332ba4689cf856222128d_amadey_elex_remcos_smoke-loader

kernel32

user32

gdi32

winhttp

msimg32

generic