2026-07-05_0bbc497fe4bbfa4031b0ec2fdac47669_amadey_elex_magniber_manuscrypt_remcos_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_0bbc497fe4bbfa4031b0ec2fdac47669_amadey_elex_magniber_manuscrypt_remcos_rhadamanthys_smoke-loader_stop
Size 28.2MB
Sample260705-g1ytwset8j
SHA256 5c8d28008ad4721eeb5fb374b461ec8f39a7c8573bbbd97a473a5d34c5566ed6
MD5 0bbc497fe4bbfa4031b0ec2fdac47669
SHA1 3dde6a68b161b1149d543c142dda271bffde1413
SHA512 dcd28380dac88ce207d6851b90ea3d8d504586aee585060a39b0c0ae713c4c28b027f2e4940cfe180ae54a4b5be96cb7c5fb92fc9fa3880462b943f1ac37a9db
SSDEEP 786432:s0n8vq5b9kNhPmaZZ8Qx6wBWlmY7Ve/oZyTymvZtw7Xmf05Y:sBql0pJwvBQYxTyTyQtw7XF5Y
TLSH
T1A55733047BC0DCF2E5B5113902168728EA7AB41667A81DCB7FEC0CBA6F9A3CC6776151
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_0bbc497fe4bbfa4031b0ec2fdac47669_amadey_elex_magniber_manuscrypt_remcos_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-05_0bbc497fe4bbfa4031b0ec2fdac47669_amadey_elex_magniber_manuscrypt_remcos_rhadamanthys_smoke-loader_stop

.exe 28.2MB

2026-07-05_0bbc497fe4bbfa4031b0ec2fdac47669_amadey_elex_magniber_manuscrypt_remcos_rhadamanthys_smoke-loader_stop

IMPHASH a7b26b4bdefb616ffb9429b95e90b590
SHA256 5c8d28008ad4721eeb5fb374b461ec8f39a7c8573bbbd97a473a5d34c5566ed6
MD5 0bbc497fe4bbfa4031b0ec2fdac47669
SHA1 3dde6a68b161b1149d543c142dda271bffde1413
SHA512 dcd28380dac88ce207d6851b90ea3d8d504586aee585060a39b0c0ae713c4c28b027f2e4940cfe180ae54a4b5be96cb7c5fb92fc9fa3880462b943f1ac37a9db
SSDEEP 786432:s0n8vq5b9kNhPmaZZ8Qx6wBWlmY7Ve/oZyTymvZtw7Xmf05Y:sBql0pJwvBQYxTyTyQtw7XF5Y
TLSH
T1A55733047BC0DCF2E5B5113902168728EA7AB41667A81DCB7FEC0CBA6F9A3CC6776151
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

322080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Drproj\NetClient5\Nc5.Agent\install\n5iclient\Release\n5iclient.pdb

comctl32

InitCommonControlsEx

ws2_32

closesocket WSACloseEvent ioctlsocket WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAEventSelect WSACreateEvent WSAStartup WSACleanup WSAGetLastError WSASend getsockname inet_ntoa WSASocketA inet_addr gethostbyname WSARecv connect htons

kernel32

OpenEventA GetWindowsDirectoryA CreateDirectoryW GetVersionExA LoadLibraryA GetProcAddress FreeLibrary FindResourceA LoadResource SizeofResource LockResource GetModuleFileNameA CreateDirectoryA FindFirstFileA lstrcmpiA FindNextFileA FindClose DeleteFileA CreateFileA WriteFile CreateProcessA GetLastError WaitForSingleObject GetExitCodeProcess OpenProcess TerminateProcess CloseHandle GetSystemDefaultLangID Sleep SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime GetSystemDirectoryA ReadFile GetFileAttributesExA GetCurrentProcessId SetFilePointer GetFileSize CreateFileW GetLocalTime GetEnvironmentVariableA GetCurrentProcess lstrlenW lstrlenA HeapFree HeapAlloc GetProcessHeap FindFirstFileW FileTimeToSystemTime GetFileTime WaitForMultipleObjects CreateProcessW GetModuleHandleA SetFileAttributesA CopyFileA DeleteFileW SetFileAttributesW CopyFileW MultiByteToWideChar WideCharToMultiByte LoadLibraryW SetLastError ExpandEnvironmentStringsW GetTickCount GetCurrentThreadId GetModuleFileNameW RemoveDirectoryA RemoveDirectoryW FindNextFileW GetSystemInfo QueryDosDeviceW GetDiskFreeSpaceA CreatePipe QueryDosDeviceA GetEnvironmentVariableW GlobalAlloc GetModuleHandleW GetDriveTypeW GetWindowsDirectoryW GetSystemDirectoryW GetTempPathW SetComputerNameW GetComputerNameW GetFileAttributesW GetFileAttributesExW GetVersionExW InterlockedDecrement GetCurrentThread LocalFree InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection FileTimeToLocalFileTime OpenFileMappingA UnmapViewOfFile ReleaseMutex SetEvent OpenMutexA MapViewOfFile FreeResource InterlockedIncrement CreateEventA InterlockedCompareExchange CreateFileMappingA InterlockedExchange ExitProcess RtlUnwind RaiseException ExitThread CreateThread GetConsoleCP GetConsoleMode GetCommandLineA GetStartupInfoA HeapReAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime LCMapStringA LCMapStringW GetCPInfo TlsGetValue TlsAlloc TlsSetValue TlsFree GetStdHandle FatalAppExitA SetConsoleCtrlHandler GetACP GetOEMCP IsValidCodePage VirtualFree VirtualAlloc HeapDestroy HeapCreate GetFileType SetHandleCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStringTypeA GetStringTypeW FlushFileBuffers GetLocaleInfoA GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetLocaleInfoW SetEndOfFile CompareStringA CompareStringW SetEnvironmentVariableA GetTimeZoneInformation SystemTimeToFileTime

user32

MessageBoxW EndDialog SetWindowLongA GetWindowLongA SetWindowPos GetWindowRect IsWindow GetParent CreateDialogParamA DialogBoxParamA CallWindowProcA DefWindowProcA InvalidateRect DrawTextA GetClientRect EndPaint BeginPaint GetDlgCtrlID GetWindow CreateWindowExW AdjustWindowRectEx ClientToScreen GetWindowLongW SetWindowLongW DrawTextW GetWindowTextW SetWindowTextW DialogBoxParamW LoadBitmapW DispatchMessageW MessageBoxA FindWindowA SendMessageA wsprintfA GetSystemMetrics SetForegroundWindow ExitWindowsEx GetDlgItem SetWindowTextA GetMessageW SendMessageW RegisterClassExW CreateDialogParamW FindWindowW DefWindowProcW CallWindowProcW MoveWindow LoadBitmapA

gdi32

TextOutW GetTextMetricsW DeleteDC StretchBlt DeleteObject SetBkMode CreateFontW GetStockObject SelectObject CreateCompatibleDC GetObjectA GetTextExtentPointA GetTextMetricsA SetTextColor GetTextExtentPoint32W GetObjectW

advapi32

IsValidSid ConvertSidToStringSidW InitializeSecurityDescriptor SetSecurityDescriptorDacl LookupPrivilegeValueW RegCreateKeyExA RegOpenKeyExA RegCloseKey RegQueryValueExA RegSetValueExA RegDeleteValueA RegDeleteKeyA RegEnumKeyExA RegQueryInfoKeyA RegEnumValueA RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegQueryInfoKeyW RegEnumKeyExW RegSetValueExW RegDeleteKeyW RegDeleteValueW RegEnumValueW LogonUserW LookupAccountSidW DuplicateTokenEx CreateProcessAsUserW QueryServiceConfigA ChangeServiceConfigA DeleteService QueryServiceStatus StartServiceA ControlService OpenSCManagerA OpenServiceA CreateServiceA CloseServiceHandle OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges EqualSid GetTokenInformation CreateProcessAsUserA SetTokenInformation RevertToSelf OpenThreadToken PrivilegeCheck ImpersonateSelf

oleaut32

CreateErrorInfo SysAllocString SysFreeString VariantInit VariantClear GetErrorInfo VariantChangeType SetErrorInfo

version

VerQueryValueA GetFileVersionInfoA VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW GetFileVersionInfoSizeA

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

wininet

FtpGetFileW FtpRemoveDirectoryW FtpDeleteFileW FtpPutFileW FtpCreateDirectoryW

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDescriptionW

winspool.drv

EnumPrintersW EnumPortsW

comdlg32

GetOpenFileNameW

shell32

ShellExecuteW

ole32

CoInitialize CoUninitialize CoInitializeEx CoCreateInstance

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_0bbc497fe4bbfa4031b0ec2fdac47669_amadey_elex_magniber_manuscrypt_remcos_rhadamanthys_smoke-loader_stop

comctl32

ws2_32

kernel32

user32

gdi32

advapi32

oleaut32

version

rpcrt4

wininet

setupapi

winspool.drv

comdlg32

shell32

ole32

generic