2026-11-09_26fe4a210704b09cb6bb5ac2a9b7b05f_elex_remcos_smoke-loader_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_26fe4a210704b09cb6bb5ac2a9b7b05f_elex_remcos_smoke-loader_wapomi
Size 2.0MB
Sample261111-ax8flaes31
SHA256 1f7e748f69e93b33f95c0da7b1216c52049ff3a641e0578a072799eaea4314a4
MD5 26fe4a210704b09cb6bb5ac2a9b7b05f
SHA1 b662f1a67856f6cd3384bd6b1f2c7307c09379ed
SHA512 8be548af118dbe129c87c61de250c26e59c2030642cc7efbefb8a4d643b94fc34dfdc4d50ce7e003709fa17241b139a04dab715fda24326bbdf3d43c41b56a37
SSDEEP 24576:twE8WQrujuTOmt14DClBuaCE+iWDBo2R7F3owVMqbCZ1be2/iJQeHNYB31GlXYHH:tLPbLQOYBVGyx90yCk1zOutfTTupnoT
TLSH
T111A59DB1B5C3417AC49219322186F33AEA659F0A052499D35FC93E777F30A205E6FA4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_26fe4a210704b09cb6bb5ac2a9b7b05f_elex_remcos_smoke-loader_wapomi

File Explorer

2026-11-09_26fe4a210704b09cb6bb5ac2a9b7b05f_elex_remcos_smoke-loader_wapomi

.exe 2.0MB

2026-11-09_26fe4a210704b09cb6bb5ac2a9b7b05f_elex_remcos_smoke-loader_wapomi

IMPHASH 2bf9c2d6028b4934bbaeb6cbc3df0a3a
SHA256 1f7e748f69e93b33f95c0da7b1216c52049ff3a641e0578a072799eaea4314a4
MD5 26fe4a210704b09cb6bb5ac2a9b7b05f
SHA1 b662f1a67856f6cd3384bd6b1f2c7307c09379ed
SHA512 8be548af118dbe129c87c61de250c26e59c2030642cc7efbefb8a4d643b94fc34dfdc4d50ce7e003709fa17241b139a04dab715fda24326bbdf3d43c41b56a37
SSDEEP 24576:twE8WQrujuTOmt14DClBuaCE+iWDBo2R7F3owVMqbCZ1be2/iJQeHNYB31GlXYHH:tLPbLQOYBVGyx90yCk1zOutfTTupnoT
TLSH
T111A59DB1B5C3417AC49219322186F33AEA659F0A052499D35FC93E777F30A205E6FA4F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4399104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileA CreateDirectoryA MultiByteToWideChar GlobalMemoryStatus GetLocalTime FindNextFileA GetVersionExA GetTempFileNameA SetThreadIdealProcessor GetExitCodeProcess MapViewOfFile UnmapViewOfFile CreateFileMappingA GetSystemDefaultLangID GetUserDefaultLangID GetSystemInfo CreateEventA HeapAlloc HeapFree HeapReAlloc ExitProcess TerminateProcess GetCurrentProcess InterlockedDecrement InterlockedIncrement ResumeThread CreateThread TlsSetValue ExitThread SetFilePointer ReadFile GetFileType CreateFileA GetTimeZoneInformation GetSystemTime GetCurrentThreadId GetCommandLineA GetVersion GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr RtlUnwind GetCPInfo DeleteFileA GetOEMCP SetHandleCount GetStdHandle LCMapStringA LCMapStringW SetStdHandle TlsAlloc SetLastError TlsGetValue UnhandledExceptionFilter WriteFile HeapSize SetEndOfFile FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID GetStringTypeA GetStringTypeW FlushFileBuffers RaiseException GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter IsProcessorFeaturePresent CreateFileW GetFileSize OutputDebugStringA lstrcmpiA GetFullPathNameA InterlockedCompareExchange InterlockedExchange GlobalLock GetFileAttributesA GlobalUnlock RemoveDirectoryA ResetEvent GetModuleHandleA GlobalAlloc WideCharToMultiByte GetSystemDirectoryA FindFirstFileA FindClose GlobalFree lstrcpyA LoadLibraryA GetProcAddress WaitForMultipleObjects LeaveCriticalSection EnterCriticalSection FreeLibrary FindResourceA GetLastError SizeofResource LoadResource LockResource FreeResource GetModuleFileNameA WaitForSingleObject SetEvent SetCurrentDirectoryA GetStartupInfoA CreateProcessA CreateMutexA CloseHandle Sleep ReleaseMutex DeleteCriticalSection InitializeCriticalSection GetACP

user32

CreateIconIndirect OpenIcon RegisterClassExA SetWindowRgn GetClassNameA SendMessageTimeoutA IsWindowVisible SetWindowPlacement EnableWindow MoveWindow SetRect AdjustWindowRectEx DestroyIcon DefWindowProcA GetWindowPlacement SetFocus EnumDisplaySettingsA ChangeDisplaySettingsA SetWindowPos DrawMenuBar CreateMenu EnumWindows DialogBoxParamA GetSystemMetrics SetCursorPos SetMenu ShowCursor DestroyMenu DestroyWindow LoadIconA GetWindowRect LoadCursorA SetClassLongA ClientToScreen SetCursor GetWindowTextA DeleteMenu PostQuitMessage GetSystemMenu CreateWindowExA RegisterClassA MessageBoxA SetWindowLongA GetWindowLongA RedrawWindow GetDC ReleaseDC GetMessageA TranslateMessage GetDlgItem SetWindowTextA ChangeDisplaySettingsExA EndDialog DispatchMessageA PeekMessageA SendMessageA ShowWindow IsIconic SetForegroundWindow FindWindowA GetKeyboardState SetKeyboardState GetCursorPos ScreenToClient PostMessageA GetSubMenu TrackPopupMenu GetClipboardData EmptyClipboard SetClipboardData CloseClipboard OpenClipboard GetClientRect SystemParametersInfoA UpdateWindow InsertMenuItemA

gdi32

SelectObject CreateCompatibleDC GetObjectA SetBkMode TextOutA CreateFontIndirectA CreateDIBSection CreateBitmap ExtCreateRegion GetDIBits GetDeviceCaps DeleteObject DeleteDC GetStockObject SetStretchBltMode StretchDIBits SetTextColor EnumFontFamiliesExA

shell32

DragQueryFileA DragAcceptFiles Shell_NotifyIconA FindExecutableA ShellExecuteExA SHGetSpecialFolderPathA DragFinish

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA RegOpenKeyA

comctl32

ord17

ole32

CoUninitialize CoCreateInstance CoInitialize

winmm

timeGetTime joyGetPosEx mciSendStringA waveInGetDevCapsA mmioStringToFOURCCA mmioOpenA waveInGetNumDevs waveOutGetDevCapsA timeGetDevCaps timeBeginPeriod joyGetNumDevs timeEndPeriod mmioClose waveOutGetNumDevs mciSendCommandA mmioAscend mmioDescend mmioRead

msacm32

acmStreamSize acmFormatSuggest acmStreamPrepareHeader acmStreamConvert acmStreamUnprepareHeader acmStreamClose acmStreamOpen

imm32

ImmAssociateContext

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

d3d9

Direct3DCreate9

dsound

ord1

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

117KB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data1

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sxdata

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

282KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

�g��u[

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_26fe4a210704b09cb6bb5ac2a9b7b05f_elex_remcos_smoke-loader_wapomi

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

winmm

msacm32

imm32

version

d3d9

dsound

generic