2026-11-03_7103566b2cf498ed1fcae28f1ebd61f5_amadey_elex_remcos_smoke-loader

General

Target
2026-11-03_7103566b2cf498ed1fcae28f1ebd61f5_amadey_elex_remcos_smoke-loader
Size 428KB
Sample261104-vrz79aes2m
SHA256 f19a9b46582b4044bf9942e6dc142bd240e7dadd6e6b86ce911a91a187f877ef
MD5 7103566b2cf498ed1fcae28f1ebd61f5
SHA1 804012559de846e57b4c1c14eefd97a04e8bc61d
SHA512 03b9a5f3a82f82152809712e568b4e57c11f78e9f989c88f75931b73044692efd9fca23c2d5f14e413d9ecf55ae3fb4daa36a3b49480f30b1f9358818e380fe6
SSDEEP 6144:ZhEhUR7NXRNcctWZzL2SeCi+AkDG/Jl7kP6YYUayvLHHZlofiDP9LtQtyfWJ:ZhEhQ1MLm+ANxl7kP6YYUDvLXoEVLOy
TLSH
T11A94BF14ABB0C034F5B716B89A799369B93E79E16B3894CB63C726DE46356D0EC30307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_7103566b2cf498ed1fcae28f1ebd61f5_amadey_elex_remcos_smoke-loader

File Explorer

2026-11-03_7103566b2cf498ed1fcae28f1ebd61f5_amadey_elex_remcos_smoke-loader

.exe 428KB

2026-11-03_7103566b2cf498ed1fcae28f1ebd61f5_amadey_elex_remcos_smoke-loader

IMPHASH 3f0b538abbe574275afcdf5200fd4d28
SHA256 f19a9b46582b4044bf9942e6dc142bd240e7dadd6e6b86ce911a91a187f877ef
MD5 7103566b2cf498ed1fcae28f1ebd61f5
SHA1 804012559de846e57b4c1c14eefd97a04e8bc61d
SHA512 03b9a5f3a82f82152809712e568b4e57c11f78e9f989c88f75931b73044692efd9fca23c2d5f14e413d9ecf55ae3fb4daa36a3b49480f30b1f9358818e380fe6
SSDEEP 6144:ZhEhUR7NXRNcctWZzL2SeCi+AkDG/Jl7kP6YYUayvLHHZlofiDP9LtQtyfWJ:ZhEhQ1MLm+ANxl7kP6YYUDvLXoEVLOy
TLSH
T11A94BF14ABB0C034F5B716B89A799369B93E79E16B3894CB63C726DE46356D0EC30307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

209328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\zahavokaxu.pdb

kernel32

LocalUnlock GetThreadContext GetPrivateProfileSectionNamesW SetCriticalSectionSpinCount GlobalMemoryStatus FindResourceA lstrcmpA FindFirstFileW EnumCalendarInfoA WriteConsoleInputW IsBadStringPtrW EnumDateFormatsExW CopyFileExW GetNumaProcessorNode GetStringTypeA SetLocalTime UnmapViewOfFile MoveFileExA GetNumberOfConsoleInputEvents GetConsoleAliasExesLengthA BuildCommDCBAndTimeoutsA SetUnhandledExceptionFilter SetDllDirectoryW GetQueuedCompletionStatus VerSetConditionMask MoveFileExW ReadConsoleA InterlockedDecrement GetCurrentProcess SetMailslotInfo SetDefaultCommConfigW SetEnvironmentVariableW GlobalLock AddConsoleAliasW GetComputerNameW SetEvent OpenSemaphoreA CreateHardLinkA LockFile GetFileAttributesExA _lclose GetModuleHandleW GetTickCount GetCommConfig GetProcessHeap IsBadReadPtr GetSystemTimeAsFileTime GetNumberFormatA GetPrivateProfileStringW GetConsoleTitleA GetCompressedFileSizeW WaitNamedPipeW EnumTimeFormatsA SetCommState GetSystemWow64DirectoryA TzSpecificLocalTimeToSystemTime WaitForMultipleObjectsEx GetProcessTimes TlsSetValue GetVolumePathNameW AllocateUserPhysicalPages FindResourceExA GlobalAlloc GetPrivateProfileIntA FatalAppExitW GetThreadSelectorEntry GetPrivateProfileStructW GetCalendarInfoW ReadFileScatter SetSystemTimeAdjustment SetVolumeMountPointA GetSystemWindowsDirectoryA ReadConsoleOutputW GetVersionExW SetConsoleCP DeleteVolumeMountPointW GetFileAttributesA lstrcpynW SetConsoleMode HeapValidate GetVolumePathNamesForVolumeNameW CreateSemaphoreA SetConsoleCursorPosition VerifyVersionInfoA WritePrivateProfileSectionW TerminateProcess IsDBCSLeadByte GetModuleFileNameW CreateActCtxA lstrcatA QueryInformationJobObject GetBinaryTypeW lstrlenW GetFullPathNameA WritePrivateProfileStringW GlobalUnlock VirtualUnlock CreateJobObjectA GetNamedPipeHandleStateW GetLargestConsoleWindowSize GetPrivateProfileIntW InterlockedExchange ReleaseActCtx SetCurrentDirectoryA GetStdHandle FindFirstFileA FreeLibraryAndExitThread GetLastError ChangeTimerQueueTimer SetLastError ReadConsoleOutputCharacterA GetProcAddress GetLongPathNameA HeapSize BackupWrite VerLanguageNameA SetFirmwareEnvironmentVariableW CreateNamedPipeA CreateJobSet EnterCriticalSection SearchPathA BuildCommDCBW DefineDosDeviceA FindClose GetPrivateProfileStringA GetAtomNameA LoadLibraryA Process32FirstW OpenMutexA ProcessIdToSessionId MoveFileA GetExitCodeThread SetCurrentDirectoryW SetFileApisToANSI QueryDosDeviceW PostQueuedCompletionStatus HeapWalk GetPrivateProfileStructA GetTapeParameters SetNamedPipeHandleState GetDefaultCommConfigA WriteProfileStringA EnumDateFormatsA WaitCommEvent FindFirstChangeNotificationA GetProcessShutdownParameters LoadLibraryExA QueueUserWorkItem ContinueDebugEvent HeapSetInformation IsDebuggerPresent FreeEnvironmentStringsW EnumResourceNamesA FindNextFileW WriteProfileStringW VirtualProtect EnumDateFormatsW CompareStringA FatalAppExitA PeekConsoleInputA WriteConsoleOutputAttribute OutputDebugStringA DuplicateHandle TlsAlloc TerminateJobObject CloseHandle GetVersion FindFirstVolumeW DeleteTimerQueueTimer GlobalAddAtomW SetFileValidData GetTempPathA FindActCtxSectionStringW ResetWriteWatch UnregisterWaitEx InterlockedPushEntrySList TlsFree GetProfileSectionW EnumSystemLocalesW CopyFileExA CommConfigDialogW DeleteFileA CreateThread lstrcpyA CreateFileW SetStdHandle RaiseException SetConsoleTitleA ExitProcess GetCommandLineW GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId InterlockedIncrement DecodePointer GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer TlsGetValue HeapCreate WriteFile GetACP GetOEMCP GetCPInfo IsValidCodePage LeaveCriticalSection LoadLibraryW UnhandledExceptionFilter HeapAlloc GetModuleFileNameA HeapReAlloc HeapQueryInformation HeapFree RtlUnwind WideCharToMultiByte LCMapStringW MultiByteToWideChar GetStringTypeW WriteConsoleW OutputDebugStringW IsProcessorFeaturePresent SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers

user32

GetMessageTime GetMenuItemID

gdi32

GetBitmapBits

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_7103566b2cf498ed1fcae28f1ebd61f5_amadey_elex_remcos_smoke-loader

kernel32

user32

gdi32

generic