2026-07-18_5f461d05d4d468a4ce9b2426363da103_amadey_elex_smoke-loader

General

Target
2026-07-18_5f461d05d4d468a4ce9b2426363da103_amadey_elex_smoke-loader
Size 283KB
Sample260718-jptrxags5v
SHA256 3b535f20b463864c2a98999c54d011f27aeee72782ec6e0d8d5e8521a9be2978
MD5 5f461d05d4d468a4ce9b2426363da103
SHA1 76b8e0bc0430165413dce3614fbbbd5e98ba66ec
SHA512 7266f4ff30ffcb79e15c600fefafdf894462698d5c7bf9324385153dc062e96ce9c8eddde00e296b8ee8314eee805efbdd077398a5617850962ee4355d25cacb
SSDEEP 3072:Q0wcz5DP283K/uKttilYXYn7jAKS2quQUOOAg0FubT2ctBu16SaXX35V:Q0LZ+l/tttTyHiUZAOX2aA18HpV
TLSH
T144546A10B5D29472E1720935096CDF95077DFE210E628B3B73D83B2E5E346CA9E23E66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_5f461d05d4d468a4ce9b2426363da103_amadey_elex_smoke-loader

File Explorer

2026-07-18_5f461d05d4d468a4ce9b2426363da103_amadey_elex_smoke-loader

.exe 283KB

2026-07-18_5f461d05d4d468a4ce9b2426363da103_amadey_elex_smoke-loader

IMPHASH 8e509efc29aa3364c399f520e8cefdac
SHA256 3b535f20b463864c2a98999c54d011f27aeee72782ec6e0d8d5e8521a9be2978
MD5 5f461d05d4d468a4ce9b2426363da103
SHA1 76b8e0bc0430165413dce3614fbbbd5e98ba66ec
SHA512 7266f4ff30ffcb79e15c600fefafdf894462698d5c7bf9324385153dc062e96ce9c8eddde00e296b8ee8314eee805efbdd077398a5617850962ee4355d25cacb
SSDEEP 3072:Q0wcz5DP283K/uKttilYXYn7jAKS2quQUOOAg0FubT2ctBu16SaXX35V:Q0LZ+l/tttTyHiUZAOX2aA18HpV
TLSH
T144546A10B5D29472E1720935096CDF95077DFE210E628B3B73D83B2E5E346CA9E23E66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

34859

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ana\code\Squirrel\Squirrel.Windows\src\StubExecutable\bin\Release\StubExecutable.pdb

kernel32

GetModuleFileNameW GetModuleHandleW FindFirstFileW FindNextFileW FindClose CreateProcessW WriteConsoleW FlushFileBuffers SetFilePointerEx GetConsoleMode WideCharToMultiByte GetLastError MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetACP HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileType FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap CloseHandle SetStdHandle HeapSize GetConsoleCP CreateFileW

user32

AllowSetForegroundWindow WaitForInputIdle

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_5f461d05d4d468a4ce9b2426363da103_amadey_elex_smoke-loader

kernel32

user32

generic