2026-08-16_62a3dabc32989b3899a86f8366124913_amadey_elex_remcos_smoke-loader

General

Target
2026-08-16_62a3dabc32989b3899a86f8366124913_amadey_elex_remcos_smoke-loader
Size 286KB
Sample260816-e24qeszzb1
SHA256 f8515dc45bd071b07f1c243ab6e28826e5a868cce7e9328fef63b9bc37c81f19
MD5 62a3dabc32989b3899a86f8366124913
SHA1 f15cc5098842ab4ee7b47e5d621ecfddd834ebd6
SHA512 577eab94e0507ed600968fd4633077f1537d705deae7f1cd068e71663aab77f1648a6475addaf6ea8ad4fa21a184da20910ef790345d7c143562b63f6ee25025
SSDEEP 3072:m4/aJG5FFYQsgrYwf0CK6S6GbR/cOAg0FubwTpNEaX30W5Vr8M:m433drRf0TOuAO07EMLVr8
TLSH
T1C354900365DDBCF6D8360630777793E8C72DEC153961CA2EA6C4125E8ABC183B522BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_62a3dabc32989b3899a86f8366124913_amadey_elex_remcos_smoke-loader

File Explorer

2026-08-16_62a3dabc32989b3899a86f8366124913_amadey_elex_remcos_smoke-loader

.exe 286KB

2026-08-16_62a3dabc32989b3899a86f8366124913_amadey_elex_remcos_smoke-loader

IMPHASH 8e509efc29aa3364c399f520e8cefdac
SHA256 f8515dc45bd071b07f1c243ab6e28826e5a868cce7e9328fef63b9bc37c81f19
MD5 62a3dabc32989b3899a86f8366124913
SHA1 f15cc5098842ab4ee7b47e5d621ecfddd834ebd6
SHA512 577eab94e0507ed600968fd4633077f1537d705deae7f1cd068e71663aab77f1648a6475addaf6ea8ad4fa21a184da20910ef790345d7c143562b63f6ee25025
SSDEEP 3072:m4/aJG5FFYQsgrYwf0CK6S6GbR/cOAg0FubwTpNEaX30W5Vr8M:m433drRf0TOuAO07EMLVr8
TLSH
T1C354900365DDBCF6D8360630777793E8C72DEC153961CA2EA6C4125E8ABC183B522BE5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

34859

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\janha\git\Squirrel.Msi\Release\StubExecutable.pdb

kernel32

GetModuleFileNameW GetModuleHandleW FindFirstFileW FindNextFileW FindClose CreateProcessW WriteConsoleW FlushFileBuffers SetFilePointerEx GetConsoleMode WideCharToMultiByte GetLastError MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetACP HeapFree HeapAlloc IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileType FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap CloseHandle SetStdHandle HeapSize GetConsoleCP CreateFileW

user32

AllowSetForegroundWindow WaitForInputIdle

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_62a3dabc32989b3899a86f8366124913_amadey_elex_remcos_smoke-loader

kernel32

user32

generic