2026-05-22_e375bd3a2742a3893bff902433bb81b8_amadey_elex_remcos_smoke-loader

General

Target
2026-05-22_e375bd3a2742a3893bff902433bb81b8_amadey_elex_remcos_smoke-loader
Size 307KB
Sample260522-ezblvset3j
SHA256 214e29f704d6bde580a5ed02500535b9ad3093f01a5d98eded065bb0df85dabf
MD5 e375bd3a2742a3893bff902433bb81b8
SHA1 9afc11ff0858b88672daf402b6eff64e7c048bfb
SHA512 07aa56c4c58f23098742b3f87e5ec1f98f3067e6699a873e5173f0848f076528812ab1739e1b4353b6c7288e53860bf5f041f7dd5aa7ca8804ab4acb46ef7a6d
SSDEEP 6144:fC3JfRT/fujB9ix8+3joMYHAOyp8WLuN1FoR/Vr8:fC3VxIB9ix8+3jods6WqNboR/Vo
TLSH
T17C64170366DDBCE2C07666703B7B97D5C72EEC100975C92F63D4025A8A7C183B662BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-22_e375bd3a2742a3893bff902433bb81b8_amadey_elex_remcos_smoke-loader

File Explorer

2026-05-22_e375bd3a2742a3893bff902433bb81b8_amadey_elex_remcos_smoke-loader

.exe 307KB

2026-05-22_e375bd3a2742a3893bff902433bb81b8_amadey_elex_remcos_smoke-loader

IMPHASH 8e509efc29aa3364c399f520e8cefdac
SHA256 214e29f704d6bde580a5ed02500535b9ad3093f01a5d98eded065bb0df85dabf
MD5 e375bd3a2742a3893bff902433bb81b8
SHA1 9afc11ff0858b88672daf402b6eff64e7c048bfb
SHA512 07aa56c4c58f23098742b3f87e5ec1f98f3067e6699a873e5173f0848f076528812ab1739e1b4353b6c7288e53860bf5f041f7dd5aa7ca8804ab4acb46ef7a6d
SSDEEP 6144:fC3JfRT/fujB9ix8+3joMYHAOyp8WLuN1FoR/Vr8:fC3VxIB9ix8+3jods6WqNboR/Vo
TLSH
T17C64170366DDBCE2C07666703B7B97D5C72EEC100975C92F63D4025A8A7C183B662BE6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

34859

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\janha\git\Squirrel.Msi\Release\StubExecutable.pdb

kernel32

GetModuleFileNameW GetModuleHandleW FindFirstFileW FindNextFileW FindClose CreateProcessW WriteConsoleW FlushFileBuffers SetFilePointerEx GetConsoleMode WideCharToMultiByte GetLastError MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetACP HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileType FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap CloseHandle SetStdHandle HeapSize GetConsoleCP CreateFileW

user32

AllowSetForegroundWindow WaitForInputIdle

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_e375bd3a2742a3893bff902433bb81b8_amadey_elex_remcos_smoke-loader

kernel32

user32

generic