2026-11-03_94afe7a87deaa2a56f0405a78aa5ce39_amadey_elex_remcos_smoke-loader

General

Target
2026-11-03_94afe7a87deaa2a56f0405a78aa5ce39_amadey_elex_remcos_smoke-loader
Size 11.7MB
Sample261104-qstdwadf32
SHA256 694ceb78aab7e554bc34d4f6a3635bac7c161ca61097de89a0be2919a0c6008b
MD5 94afe7a87deaa2a56f0405a78aa5ce39
SHA1 b864b781e5a8368e9b883e588540681a7ce91232
SHA512 653580018425eb23dece120dba4e25e3a90f86fd2b885e71c7010947a7943adfaa2aec3dbb70c21d852cd7ec979fc463a610799cee9ab740cd71ee092fa5bf15
SSDEEP 98304:q+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaf:
TLSH
T12BC66B25DA7316B3D06549BDA26C3FBDDBFE83B0D3105437504868F898233AB29E5687
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_94afe7a87deaa2a56f0405a78aa5ce39_amadey_elex_remcos_smoke-loader

File Explorer

2026-11-03_94afe7a87deaa2a56f0405a78aa5ce39_amadey_elex_remcos_smoke-loader

.exe 11.7MB

2026-11-03_94afe7a87deaa2a56f0405a78aa5ce39_amadey_elex_remcos_smoke-loader

IMPHASH 9e4746628ebaf71569a51552a1011d76
SHA256 694ceb78aab7e554bc34d4f6a3635bac7c161ca61097de89a0be2919a0c6008b
MD5 94afe7a87deaa2a56f0405a78aa5ce39
SHA1 b864b781e5a8368e9b883e588540681a7ce91232
SHA512 653580018425eb23dece120dba4e25e3a90f86fd2b885e71c7010947a7943adfaa2aec3dbb70c21d852cd7ec979fc463a610799cee9ab740cd71ee092fa5bf15
SSDEEP 98304:q+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaf:
TLSH
T12BC66B25DA7316B3D06549BDA26C3FBDDBFE83B0D3105437504868F898233AB29E5687
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

111136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\mici juyuwukepom52 fogoyujeno73\lahegay.pdb

kernel32

GetConsoleAliasesLengthW TlsGetValue SetDllDirectoryW InterlockedIncrement GetProfileSectionA SetConsoleScreenBufferSize SetVolumeMountPointW FreeEnvironmentStringsA IsBadReadPtr GetSystemTimeAsFileTime GetPrivateProfileStringW ReadConsoleW GetSystemWow64DirectoryA CreateActCtxW ActivateActCtx GlobalAlloc GetSystemDirectoryW SetFileShortNameW ReadConsoleInputA CopyFileW GetSystemWindowsDirectoryA SetConsoleMode HeapValidate GetModuleFileNameW CompareStringW GetACP GetStartupInfoW WritePrivateProfileStringW GetNamedPipeHandleStateW VerifyVersionInfoW FindFirstFileExA GetHandleInformation GetLastError IsDBCSLeadByteEx GetCurrentDirectoryW SetLastError BackupRead GetProcAddress IsBadHugeWritePtr WriteProfileSectionA IsValidCodePage GlobalGetAtomNameA BuildCommDCBW LoadLibraryA OpenWaitableTimerW GetModuleFileNameA SetConsoleCursorInfo GetFileTime SetProcessShutdownParameters GetVersionExA GetWindowsDirectoryW DeleteFileW TlsFree LocalFileTimeToFileTime CloseHandle ReadFile MoveFileA DeleteFileA GetCommandLineW HeapSetInformation EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection DecodePointer TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer IsProcessorFeaturePresent QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId InterlockedDecrement GetModuleHandleW ExitProcess FreeEnvironmentStringsW GetEnvironmentStringsW TlsAlloc TlsSetValue HeapCreate WriteFile SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW RtlUnwind MultiByteToWideChar GetOEMCP GetCPInfo RaiseException HeapAlloc HeapReAlloc HeapSize HeapQueryInformation HeapFree FlushFileBuffers SetStdHandle GetStringTypeW LCMapStringW CreateFileW

user32

GetCursorInfo GetMenuInfo GetMessageTime

winhttp

WinHttpCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_94afe7a87deaa2a56f0405a78aa5ce39_amadey_elex_remcos_smoke-loader

kernel32

user32

winhttp

generic