2026-11-03_78c1aeebd67b965013c68f3ac491e322_amadey_elex_remcos_smoke-loader_stop

General

Target
2026-11-03_78c1aeebd67b965013c68f3ac491e322_amadey_elex_remcos_smoke-loader_stop
Size 344KB
Sample261104-tx31nabv7x
SHA256 6ad150150f18b97e95e7f12465f502694e50e870e8f118ca52783124771211cf
MD5 78c1aeebd67b965013c68f3ac491e322
SHA1 6fb2fc28e587f9188e592f85c56fbeaa115726e4
SHA512 6381dad880a2f0d5b7e08eff89307320e740cd6d2552f8a482b6a6fd4d71dae07e1d723a53ac342fe2c35760760d58bbfbe119fd2978f6025b4ae5fbf1c43f65
SSDEEP 6144:lulpMmWxFAppqxH1Hj1uJGEYpxQoCM4TU79zJlDpIafgul30:klp8Huqv8YTQoC9U7HlDpZYb
TLSH
T1E474CF10B690C035E4F611F84A7A93ACB93E7EE09B6458CF62D52AEE16346E5FC31317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_78c1aeebd67b965013c68f3ac491e322_amadey_elex_remcos_smoke-loader_stop

File Explorer

2026-11-03_78c1aeebd67b965013c68f3ac491e322_amadey_elex_remcos_smoke-loader_stop

.exe 344KB

2026-11-03_78c1aeebd67b965013c68f3ac491e322_amadey_elex_remcos_smoke-loader_stop

IMPHASH bcd242babe76d65887a5afa410efd13c
SHA256 6ad150150f18b97e95e7f12465f502694e50e870e8f118ca52783124771211cf
MD5 78c1aeebd67b965013c68f3ac491e322
SHA1 6fb2fc28e587f9188e592f85c56fbeaa115726e4
SHA512 6381dad880a2f0d5b7e08eff89307320e740cd6d2552f8a482b6a6fd4d71dae07e1d723a53ac342fe2c35760760d58bbfbe119fd2978f6025b4ae5fbf1c43f65
SSDEEP 6144:lulpMmWxFAppqxH1Hj1uJGEYpxQoCM4TU79zJlDpIafgul30:klp8Huqv8YTQoC9U7HlDpZYb
TLSH
T1E474CF10B690C035E4F611F84A7A93ACB93E7EE09B6458CF62D52AEE16346E5FC31317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

174288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

QueryDosDeviceA GetTickCount EnumCalendarInfoExW ReadConsoleW CreateActCtxW AddRefActCtx LoadLibraryW SetCommConfig GetConsoleWindow GetStringTypeExW SetConsoleMode IsBadWritePtr GetOverlappedResult GetSystemWindowsDirectoryW GetProcAddress GetProcessHeaps ResetEvent WriteConsoleA LocalAlloc CreateEventW GetOEMCP lstrcatW EndUpdateResourceA InterlockedIncrement EnumDateFormatsExW lstrlenA FindFirstChangeNotificationW GetCommandLineA GetStartupInfoA HeapValidate IsBadReadPtr RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleFileNameW QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleW Sleep InterlockedDecrement ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetLastError GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapDestroy HeapCreate HeapFree VirtualFree WriteFile HeapAlloc HeapSize HeapReAlloc VirtualAlloc GetACP GetCPInfo IsValidCodePage InitializeCriticalSectionAndSpinCount DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW RtlUnwind LoadLibraryA MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle GetConsoleOutputCP CreateFileA CloseHandle FlushFileBuffers GetModuleHandleA

user32

GetCursor

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_78c1aeebd67b965013c68f3ac491e322_amadey_elex_remcos_smoke-loader_stop

kernel32

user32

generic