General
- Target 2026-04-05_a16599bf01236304ab50e2ddabbad828_amadey_elex_glassworm_remcos_rhadamanthys_smoke-loader_stop_tofsee
- Size 1.6MB
- Sample260405-d94vqaet31
- SHA256 2e869110185548b08501e699d80c74723e74d21ee3df806e2f6679aa131354cc
- MD5 a16599bf01236304ab50e2ddabbad828
- SHA1 d86bbbf6d2f4088055f07c1569e15d3c79b4b3f8
- SHA512 dbcffd15cc1489df1bfde637ca1544febed2d44b916233cbab27374c375bf45d5075241ea294745f4115757d12af8ffc27537f3e562fa08749ff1ef1216504ef
- SSDEEP 24576:oKn52aVeJBAVDKUTbQIzFLwLIM0iwg99V:o8AeVmgbQIzZMPX
- TLSH T159751757EB919AE8E65D09366F584150D72EF221AB4F2350386C420DCF8738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-05_a16599bf01236304ab50e2ddabbad828_amadey_elex_glassworm_remcos_rhadamanthys_smoke-loader_stop_tofsee.exe
Resource
win10v2004-20260130-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-05_a16599bf01236304ab50e2ddabbad828_amadey_elex_glassworm_remcos_rhadamanthys_smoke-loader_stop_tofsee.exe
Resource
win11-20260130-en
13 signatures
150 seconds
Malware Config
Extracted
Family
-
smokeloader
Botnet
-
lab
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://host-file-host6.com/
-
http://host-host-file8.com/
rc4.i32
rc4.i32
Targets
-
- Target 2026-04-05_a16599bf01236304ab50e2ddabbad828_amadey_elex_glassworm_remcos_rhadamanthys_smoke-loader_stop_tofsee
- Size 1.6MB
- SHA256 2e869110185548b08501e699d80c74723e74d21ee3df806e2f6679aa131354cc
- MD5 a16599bf01236304ab50e2ddabbad828
- SHA1 d86bbbf6d2f4088055f07c1569e15d3c79b4b3f8
- SHA512 dbcffd15cc1489df1bfde637ca1544febed2d44b916233cbab27374c375bf45d5075241ea294745f4115757d12af8ffc27537f3e562fa08749ff1ef1216504ef
- SSDEEP 24576:oKn52aVeJBAVDKUTbQIzFLwLIM0iwg99V:o8AeVmgbQIzZMPX
- TLSH T159751757EB919AE8E65D09366F584150D72EF221AB4F2350386C420DCF8738B8F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Smokeloader family
-
Deletes itself
-
Suspicious use of SetThreadContext