2026-07-20_f23817823d407b377749ca8af6c33b4e_amadey_elex_remcos_rhadamanthys_smoke-loader

General

Target
2026-07-20_f23817823d407b377749ca8af6c33b4e_amadey_elex_remcos_rhadamanthys_smoke-loader
Size 612KB
Sample260720-sspf2aet8r
SHA256 041a07b5b9b7844027171affdd7050269d309cd08ca07f4a937200bd10d76fdc
MD5 f23817823d407b377749ca8af6c33b4e
SHA1 3d679921da07042f08ed69996dff40811b7e1b4b
SHA512 8567330107e69d1303ae992fef7dd36557dc7ee90e7976f7c809182bbac3610668bd6e6f3cd212328e237059ec5c02427f4b09c733c171d0711db61c965120ae
SSDEEP 12288:3wBhHmq7dq93QKqZwe/8n3Vm36vk6JR2BjajFnGfo1wQGiq:3YHI93Rq/yVmqvXJR2RsxGfMhG
TLSH
T1A4D4F1256091D173D09711320E6BD7A22D3A3E350B2A5DC772D837BD6E712C16AFA32B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_f23817823d407b377749ca8af6c33b4e_amadey_elex_remcos_rhadamanthys_smoke-loader

File Explorer

2026-07-20_f23817823d407b377749ca8af6c33b4e_amadey_elex_remcos_rhadamanthys_smoke-loader

.exe 612KB

2026-07-20_f23817823d407b377749ca8af6c33b4e_amadey_elex_remcos_rhadamanthys_smoke-loader

IMPHASH ebf76123c1fc25464cc973cb048acbab
SHA256 041a07b5b9b7844027171affdd7050269d309cd08ca07f4a937200bd10d76fdc
MD5 f23817823d407b377749ca8af6c33b4e
SHA1 3d679921da07042f08ed69996dff40811b7e1b4b
SHA512 8567330107e69d1303ae992fef7dd36557dc7ee90e7976f7c809182bbac3610668bd6e6f3cd212328e237059ec5c02427f4b09c733c171d0711db61c965120ae
SSDEEP 12288:3wBhHmq7dq93QKqZwe/8n3Vm36vk6JR2BjajFnGfo1wQGiq:3YHI93Rq/yVmqvXJR2RsxGfMhG
TLSH
T1A4D4F1256091D173D09711320E6BD7A22D3A3E350B2A5DC772D837BD6E712C16AFA32B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

196225

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetProcAddress LoadLibraryA SizeofResource LockResource LoadResource FindResourceW FindResourceExW SystemTimeToFileTime LoadLibraryW GetModuleHandleA GetCurrentProcess EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetLastError CloseHandle lstrlenW WideCharToMultiByte MoveFileExW GetTempFileNameW GetTempPathW DeleteFileW MoveFileW WriteFile ReadFile GetFileSize CreateFileW SetFileAttributesW CreateProcessW GetModuleFileNameW GetComputerNameA Sleep GetSystemTime HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException InitializeCriticalSectionAndSpinCount LocalAlloc SetEndOfFile WriteConsoleW SetStdHandle GetStringTypeW InterlockedExchange GetCommandLineW HeapSetInformation GetStartupInfoW RtlUnwind GetCurrentThreadId EncodePointer DecodePointer SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers MultiByteToWideChar FreeLibrary

ole32

CoCreateInstance CoInitialize

shell32

SHGetSpecialFolderPathW ShellExecuteW

shlwapi

PathAddExtensionW PathAppendW PathRemoveExtensionW PathFileExistsW PathIsRootW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_f23817823d407b377749ca8af6c33b4e_amadey_elex_remcos_rhadamanthys_smoke-loader

kernel32

ole32

shell32

shlwapi

generic