2026-09-24_5c0c64affce3a94c3b475d2e89c2fa6c_amadey_elex_remcos_smoke-loader_stop
Amadey loader, packed, anti-debug
Profiled named-pipe backdoor with obfuscated string surfacex86 validates and manually maps an in-memory PE
SHA-2563a2e36a8f8d59846632be8fbbcb16af7370043a19a6038d04415859a64c66212
Evidence
⋯3 more rows
0x3f000000000000000000000000000000000................
0x400d24d040000000000784504008e450400.M......xE...E..
0x4109e450400ae450400ca450400de450400.E...E...E...E..
0x420f2450400024604001c46040036460400.E...F...F..6F..
0x4304e460400624604006e4604007c460400NF..bF..nF..|F..
0x44094460400a2460400c4460400d0460400.F...F...F...F..
0x450e4460400004704001847040034470400.F...G...G..4G..
0x46046470400564704006447040074470400FG..VG..dG..tG..
0x4708247040094470400aa470400be470400.G...G...G...G..
0x480cc470400dc470400f047040002480400.G...G...G...H..
0x49012480400304804004248040058480400.H..0H..BH..XH..
0x4a068480400804804009c480400b0480400hH...H...H...H..
0x4b0c4480400d8480400e8480400fc480400.H...H...H...H..
0x4c00a49040026490400324904003e490400.I..&I..2I..>I..
0x4d050490400644904007e49040066450400PI..dI..~I..fE..
0x4e09a490400ac490400c6490400da490400.I...I...I...I..
0x4f0f0490400004a04001c4a0400364a0400.I...J...J..6J..
0x500424a0400584a04006c4a0400804a0400BJ..XJ..lJ...J..
0x510944a0400ae4a0400c04a0400d04a0400.J...J...J...J..
0x520e44a0400f64a04000a4b0400164b0400.J...J...K...K..
0x530224b0400364b0400544b0400684b0400"K..6K..TK..hK..
0x540784b0400924b0400b24b0400c04b0400xK...K...K...K..
0x550d44b0400e04b0400f04b0400064c0400.K...K...K...L..
0x560124c0400244c0400384c04004a4c0400.L..$L..8L..JL..
0x5705a4c0400664c04007a4c0400984c0400ZL..fL..zL...L..
0x580b24c0400ce4c0400e24c0400f84c0400.L...L...L...L..
0x5900c4d04001e4d0400344d0400464d0400.M...M..4M..FM..
0x5a05e4d0400704d0400884d04009a4d0400^M..pM...M...M..
0x5b0a84d04008a49040054450400f84d0400.M...I..TE...M..
0x5c0104e0400284e04003e4e0400544e0400.N..(N..>N..TN..
0x5d0724e04007a4e0400964e0400ae4e0400rN..zN...N...N..
0x5e0c64e0400d84e0400e44e0400f84e0400.N...N...N...N..
0x5f0144f0400324f0400464f04005c4f0400.O..2O..FO..\O..
0x6006c4f0400784f04008a4f04009a4f0400lO..xO...O...O..
0x610aa4f0400b64f0400c64f0400d64f0400.O...O...O...O..
0x620e84f0400fc4f0400085004001e500400.O...O...P...P..
0x63028500400385004004e5004005e500400(P..8P..NP..^P..
0x6406c5004008250040090500400a0500400lP...P...P...P..
0x650b2500400cc500400dc500400f2500400.P...P...P...P..
0x6600c510400265104003851040046510400.Q..&Q..8Q..FQ..
0x67054510400625104007851040082510400TQ..bQ..xQ...Q..
0x72000000000a0794200f027440090944200.....yB..'D...B.
0x73000000000000000000000000000000000................
0x740000000007586c5610000000002000000....u..a........
0x7505c00000018a400001898000000000000\...............
0x76062616420616c6c6f636174696f6e0000bad allocation..
0x77067006f00780075006e00690074006f00g.o.x.u.n.i.t.o.
0x78063007500740075006400610078006900c.u.t.u.d.a.x.i.
0x7906a00690077006f0074006f0000000000j.i.w.o.t.o.....
0x7a0686f626f77697869686f6d6179757265hobowixihomayure
0x7b0636967616a69206661627574757a6174cigaji fabutuzat
0x7c065736f79617900006500680075007300esoyay..e.h.u.s.
0x7d069006c00610062006f0076006f006600i.l.a.b.o.v.o.f.
0x7e06500720061007700690068006f007000e.r.a.w.i.h.o.p.
0x7f06f006a0069006e006100740069006d00o.j.i.n.a.t.i.m.
0x8006f007300650070007500680075006300o.s.e.p.u.h.u.c.
0x81061007000610073006100740075006600a.p.a.s.a.t.u.f.
0x8206f00630065006c00750074006f006800o.c.e.l.u.t.o.h.
0x83069006400690074006900790069006400i.d.i.t.i.y.i.d.
0x840690062006500000074616e7567697765i.b.e...tanugiwe
0x85063657665777570656e756e696b757861cevewupenunikuxa
0x8606769676978697a657a656a0059756b20gigixizezej.Yuk
0x8706769676576696e7577756d6f2067756egigevinuwumo gun
0x880657a616a697020786974757865206475ezajip xituxe du
0x8907461736f7861000042656a6f646f7069tasoxa..Bejodopi
0x8a0206765676f666579656e652073756b65 gegofeyene suke
0x8b07869726520797578756c75206b656a6fxire yuxulu kejo
0x8c06669766f72617265000000004c757a75fivorare....Luzu
0x8d06c6f797520796967656e757465666f66loyu yigenutefof
0x8e06f6320726962752079757a69206a7567oc ribu yuzi jug
0x8f07568000076006100770075006e006100uh..v.a.w.u.n.a.
0x9006b006500630069007600690000000000k.e.c.i.v.i.....
0x9106a00610074006f007200750076006f00j.a.t.o.r.u.v.o.
0x9206d006f006c0075006c00610067006100m.o.l.u.l.a.g.a.
0x9306300650078006f006a006f0063000000c.e.x.o.j.o.c...
0x94079007500760061006b006f006c006500y.u.v.a.k.o.l.e.
0x950790069006c0061007800750067007500y.i.l.a.x.u.g.u.
0x960790065006c00690066006f0078006100y.e.l.i.f.o.x.a.
0x97072006f00770075006e00610063006500r.o.w.u.n.a.c.e.
0x98066006f00780075007600000000000000f.o.x.u.v.......
0x99078006f006e00750072006f006d007500x.o.n.u.r.o.m.u.
0x9a06a006f0079007500670069006c006500j.o.y.u.g.i.l.e.
0x9b06d006900640075006e00750064006100m.i.d.u.n.u.d.a.
0x9c073007500760069007700650062000000s.u.v.i.w.e.b...
0x9d0766f63616365736f796f676f746f736fvocacesoyogotoso
0x9e06e000000766566656461727579616b6fn...vefedaruyako
0x9f06361666f6a6f68696d61646968617975cafojohimadihayu
0xa006e6170656a657269686163756d610000napejerihacuma..
0xa107700650073006900700069006a006500w.e.s.i.p.i.j.e.
0xf282800730069007a0065005f0074002900(.s.i.z.e._.t.).
0xf3828005f004c0061007300740020002d00(._.L.a.s.t. .-.
0xf4820005f00460069007200730074002900 ._.F.i.r.s.t.).
0xf5822002c00200030002900000000000000".,. .0.).......
0xf6843003a005c00500072006f0067007200C.:.\.P.r.o.g.r.
0xf7861006d002000460069006c0065007300a.m. .F.i.l.e.s.
0xf882000280078003800360029005c004d00 .(.x.8.6.).\.M.
0xf986900630072006f0073006f0066007400i.c.r.o.s.o.f.t.
0xfa82000560069007300750061006c002000 .V.i.s.u.a.l. .
0xfb8530074007500640069006f0020003900S.t.u.d.i.o. .9.
0xfc82e0030005c00560043005c0069006e00..0.\.V.C.\.i.n.
0xfd863006c007500640065005c0078006c00c.l.u.d.e.\.x.l.
0xfe86f00630061006c006500000000000000o.c.a.l.e.......
0xff87300740064003a003a00630074007900s.t.d.:.:.c.t.y.
0x1008700065003c0077006300680061007200p.e.<.w.c.h.a.r.
0x10185f0074003e003a003a005f0044006f00_.t.>.:.:._.D.o.
0x10285f006e006100720072006f0077005f00_.n.a.r.r.o.w._.
0x104842e9410075e2410099e9410098e24100B.A.u.A...A...A.
0x10587ee24100efe3410074e44100fde94100~.A...A.t.A...A.
0x106847eb410090e2410075e2410095e24100G.A...A.u.A...A.
0x10889ef141000000000043003a005c005000..A.....C.:.\.P.
0x109872006f006700720061006d0020004600r.o.g.r.a.m. .F.
0x10a869006c00650073002000280078003800i.l.e.s. .(.x.8.
0x10b8360029005c004d006900630072006f006.).\.M.i.c.r.o.
0x10c873006f00660074002000560069007300s.o.f.t. .V.i.s.
0x10d8750061006c0020005300740075006400u.a.l. .S.t.u.d.
0x10e869006f00200039002e0030005c005600i.o. .9...0.\.V.
0x10f843005c0069006e0063006c0075006400C.\.i.n.c.l.u.d.
0x110865005c00780073007400720069006e00e.\.x.s.t.r.i.n.
0x11186700000080a940003bf24100faee4100g.....@.;.A...A.
0x1128433a5c50726f6772616d2046696c6573C:\Program Files
0x11382028783836295c4d6963726f736f6674 (x86)\Microsoft
0x11482056697375616c2053747564696f2039 Visual Studio 9
0x11582e305c56435c696e636c7564655c786c.0\VC\include\xl
0x11686f63616c65000000696f735f62617365ocale...ios_base
0x11783a3a656f666269742073657400000000::eofbit set....
0x1188696f735f626173653a3a6661696c6269ios_base::failbi
0x11987420736574000000696f735f62617365t set...ios_base
0x11a83a3a6261646269742073657400000000::badbit set....
0x11b8433a5c50726f6772616d2046696c6573C:\Program Files
0x11c82028783836295c4d6963726f736f6674 (x86)\Microsoft
0x11d82056697375616c2053747564696f2039 Visual Studio 9
0x11e82e305c56435c696e636c7564655c7869.0\VC\include\xi
0x11f86f736261736500006261642063617374osbase..bad cast
0x120800000000000000000800000000000000................
0x121804000000000000000c00000000000000................
0x2638c0c1c2c3c4c5c6c7c8c9cacbcccdcecf................
0x2648d0d1d2d3d4d5d6d7d8d9dadbdcdddedf................
0x2658e0e1e2e3e4e5e6e7e8e9eaebecedeeef................
0x2668f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff................
0x2678000102030405060708090a0b0c0d0e0f................
0x2688101112131415161718191a1b1c1d1e1f................
0x2698202122232425262728292a2b2c2d2e2f !"#$%&'()*+,-./
0x26a8303132333435363738393a3b3c3d3e3f0123456789:;<=>?
0x26b8406162636465666768696a6b6c6d6e6f@abcdefghijklmno
0x26c8707172737475767778797a5b5c5d5e5fpqrstuvwxyz[\]^_
0x26d8606162636465666768696a6b6c6d6e6f`abcdefghijklmno
0x26e8707172737475767778797a7b7c7d7e7fpqrstuvwxyz{|}~.
0x26f8808182838485868788898a8b8c8d8e8f................
0x2708909192939495969798999a9b9c9d9e9f................
0x2718a0a1a2a3a4a5a6a7a8a9aaabacadaeaf................
0x2728b0b1b2b3b4b5b6b7b8b9babbbcbdbebf................
0x2738c0c1c2c3c4c5c6c7c8c9cacbcccdcecf................
0x2748d0d1d2d3d4d5d6d7d8d9dadbdcdddedf................
0x2758e0e1e2e3e4e5e6e7e8e9eaebecedeeef................
0x2768f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff................
0x2778808182838485868788898a8b8c8d8e8f................
0x2788909192939495969798999a9b9c9d9e9f................
0x2798a0a1a2a3a4a5a6a7a8a9aaabacadaeaf................
0x27a8b0b1b2b3b4b5b6b7b8b9babbbcbdbe ...............
0x22f184df064890d00000000595f5e5b8be55dM.d......Y_^[..]
0x22f28c3cccccccccccccc8bff558bec833d0c..........U...=.
0x22f38dd4500017505e86df700008b450850e8.E..u..m....E.P.
0x22f48b4f7000083c40468ff000000e877d100.......h.....w..
0x22f580083c4045dc3cccc8bff558bec83ec08....].....U.....
0x22f68c745fc00004000837dfc00740e8b45fc.E...@..}..t..E.
0x22f780fb70881f94d5a0000740433c0eb498b.....MZ..t.3..I.
0x22f8855fc8b45fc03423c8945f88b4df88139U..E..B<.E..M..9
0x22f9850450000740433c0eb2e8b55f80fb742PE..t.3....U...B
0x22fa8183d0b010000740433c0eb1c8b4df883.=....t.3....M..
0x22fb879740e770433c0eb0f8b55f833c083bayt.w.3....U.3...
0x22fc8e8000000000f95c08be55dc3cccccccc..........].....
0x22fd8cccccccccccccccc8bff558bec83ec14..........U.....
0x22fe88b4508508d4df0e84c0000008b4d2851.E.P.M..L....M(Q
0x22ff88b5524528b4520508b4d1c518b551852.U$R.E P.M.Q.U.R
0x230088b4514508b4d10518b550c528d4df0e8.E.P.M.Q.U.R.M..
0x230183401000050e83e01000083c4248945ec4...P.>.....$.E.
0x230288d4df0e8f00000008b45ec8be55dc3cc.M.......E...]..
0x23038cccccccccc .....