2026-06-02_244fec7b6d4c6bb908569f2b8814b5b2_amadey_elex_remcos_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-02_244fec7b6d4c6bb908569f2b8814b5b2_amadey_elex_remcos_rhadamanthys_smoke-loader
Size 603KB
Sample260602-bprnjsav3w
SHA256 9d92ed364e359fda0f1ce827bc2d18e29fac613bb6ffcb8bf0bd715f7b7370d4
MD5 244fec7b6d4c6bb908569f2b8814b5b2
SHA1 f9588cc3a69583c955e0911de1ccbedab6f67f60
SHA512 bf5c0302bd192c6c41bc5ca42f4b9b6b3145d87ee017e9fb6edec50e76fb7c2c2da6cbaaddfa038d498e0fb2dd8ec1e548fe1dec00f7071da9758cbea82e176c
SSDEEP 12288:y7IRWDvFa+nhmuF3Y0scoeDuUlX6Dp15FEaNY:y7GUo+F3YlRi6FtEI
TLSH
T1A2D4082167F48035F5F37AB05AB856315B7ABC625F34C9EF1280168E49B2AC1F930B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-02_244fec7b6d4c6bb908569f2b8814b5b2_amadey_elex_remcos_rhadamanthys_smoke-loader

File Explorer

2026-06-02_244fec7b6d4c6bb908569f2b8814b5b2_amadey_elex_remcos_rhadamanthys_smoke-loader

.exe 603KB

2026-06-02_244fec7b6d4c6bb908569f2b8814b5b2_amadey_elex_remcos_rhadamanthys_smoke-loader

IMPHASH cfa06eb8ecb157d3e1e5170182639085
SHA256 9d92ed364e359fda0f1ce827bc2d18e29fac613bb6ffcb8bf0bd715f7b7370d4
MD5 244fec7b6d4c6bb908569f2b8814b5b2
SHA1 f9588cc3a69583c955e0911de1ccbedab6f67f60
SHA512 bf5c0302bd192c6c41bc5ca42f4b9b6b3145d87ee017e9fb6edec50e76fb7c2c2da6cbaaddfa038d498e0fb2dd8ec1e548fe1dec00f7071da9758cbea82e176c
SSDEEP 12288:y7IRWDvFa+nhmuF3Y0scoeDuUlX6Dp15FEaNY:y7GUo+F3YlRi6FtEI
TLSH
T1A2D4082167F48035F5F37AB05AB856315B7ABC625F34C9EF1280168E49B2AC1F930B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

189761

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

setup.pdb

kernel32

Process32NextW Process32FirstW CreateToolhelp32Snapshot GetCurrentProcessId GetNativeSystemInfo SetFilePointer HeapSetInformation CreateEventW SetEvent SizeofResource LockResource LoadResource FindResourceW GetVersionExW CompareStringW GetFileAttributesW GetModuleFileNameW ExpandEnvironmentStringsW GlobalFree OpenProcess GetSystemDirectoryW DeleteFileW GetTempFileNameW GetTempPathW LocalFree FormatMessageW ReadFile GetTimeFormatW GetDateFormatW CreateDirectoryW CopyFileW WideCharToMultiByte GetWindowsDirectoryW GetSystemInfo GetCurrentProcess GetEnvironmentVariableW GetModuleHandleW GetVersion CreateFileW EndUpdateResourceW Sleep GetDiskFreeSpaceExW DeleteCriticalSection CreateThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection MulDiv lstrlenW GetExitCodeProcess SetEndOfFile GetTickCount FindFirstFileW FindNextFileW FindClose GlobalAlloc LoadLibraryW UpdateResourceA BeginUpdateResourceA InterlockedCompareExchange FindResourceA DeleteFileA lstrlenA CreateFileA UpdateResourceW BeginUpdateResourceW GetEnvironmentVariableA SetStdHandle WriteConsoleW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID HeapSize FlushFileBuffers GetConsoleMode GetConsoleCP GetProcessHeap MultiByteToWideChar LCMapStringW GetStringTypeW GetLocaleInfoW IsValidCodePage GetOEMCP GetACP IsDebuggerPresent UnhandledExceptionFilter TerminateProcess HeapAlloc IsProcessorFeaturePresent GetSystemTimeAsFileTime QueryPerformanceCounter HeapCreate GetCurrentThreadId InterlockedExchange SwitchToThread GetLastError WaitForSingleObject CloseHandle GetProcAddress FreeLibrary WriteFile SetLastError InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc GetFileType InitializeCriticalSectionAndSpinCount LocalAlloc LoadLibraryA RaiseException GetCommandLineW GetStartupInfoW RtlUnwind HeapFree InterlockedDecrement GetCPInfo SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount

gdi32

GetStockObject EnumFontFamiliesExW CreateFontIndirectW DeleteObject CreateCompatibleDC GetDeviceCaps GetObjectW DeleteDC SelectObject GetTextMetricsW GetTextExtentPoint32W

ole32

CoUninitialize CoInitialize

secur32

GetComputerObjectNameW

shell32

ShellExecuteExW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteA

user32

MessageBoxA ShowScrollBar GetClientRect SendMessageA SetClassLongW SetWindowTextW LoadCursorW SetCursor CreateDialogIndirectParamW SetForegroundWindow EnableWindow GetFocus SetFocus ScreenToClient MoveWindow LoadIconW SetDlgItemTextW SendMessageW GetDlgItem MsgWaitForMultipleObjects PeekMessageW IsDialogMessageW TranslateMessage DispatchMessageW DestroyWindow ShowWindow SendDlgItemMessageW GetWindowRect SystemParametersInfoW ExitWindowsEx MessageBoxW DrawTextW GetSystemMetrics GetDC GetDialogBaseUnits ReleaseDC CreateDialogParamW LoadImageW

crypt32

CertFreeCertificateChain CertVerifyCertificateChainPolicy CertGetCertificateChain

wininet

InternetCrackUrlW InternetCombineUrlW

msi

ord8 ord150 ord78 ord92

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-02_244fec7b6d4c6bb908569f2b8814b5b2_amadey_elex_remcos_rhadamanthys_smoke-loader

kernel32

gdi32

ole32

secur32

shell32

user32

crypt32

wininet

msi

generic