2026-07-27_8940580681db662a40ac29f841fc8827_amadey_elex_remcos_rhadamanthys_smoke-loader

General

Target
2026-07-27_8940580681db662a40ac29f841fc8827_amadey_elex_remcos_rhadamanthys_smoke-loader
Size 1.2MB
Sample260727-j5rx9aaa69
SHA256 ae7063304ac5bf6f3fd283c5dbed5c6e3a885e59d676214cf73523e8a0617c7d
MD5 8940580681db662a40ac29f841fc8827
SHA1 6ce48ec398fd6cc2048edea015aad47e6e631329
SHA512 c5ac297573f97031dce81f973b2f7f287970217d3ab774e75c463ff8c0d654f0c1f4b26ec34e375f04d009c909c34868ac98f075459f5b8c0b615b2582dad127
SSDEEP 24576:jf4zzkF9wQ4rM3O5e+47ZS/nPKCIbg25dQEK24Ve/QQ:jh9wQ4rM3O56ZMJlBETQQ
TLSH
T1A345F1D37D4492F6D2E908B3256E8D916A357D365B6228B372C8332F88B30D35729B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_8940580681db662a40ac29f841fc8827_amadey_elex_remcos_rhadamanthys_smoke-loader

File Explorer

2026-07-27_8940580681db662a40ac29f841fc8827_amadey_elex_remcos_rhadamanthys_smoke-loader

.exe 1.2MB

2026-07-27_8940580681db662a40ac29f841fc8827_amadey_elex_remcos_rhadamanthys_smoke-loader

IMPHASH 5f465c6410f1aff3a1abd7ee074834cd
SHA256 ae7063304ac5bf6f3fd283c5dbed5c6e3a885e59d676214cf73523e8a0617c7d
MD5 8940580681db662a40ac29f841fc8827
SHA1 6ce48ec398fd6cc2048edea015aad47e6e631329
SHA512 c5ac297573f97031dce81f973b2f7f287970217d3ab774e75c463ff8c0d654f0c1f4b26ec34e375f04d009c909c34868ac98f075459f5b8c0b615b2582dad127
SSDEEP 24576:jf4zzkF9wQ4rM3O5e+47ZS/nPKCIbg25dQEK24Ve/QQ:jh9wQ4rM3O56ZMJlBETQQ
TLSH
T1A345F1D37D4492F6D2E908B3256E8D916A357D365B6228B372C8332F88B30D35729B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

197025

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetProcAddress LoadLibraryA SizeofResource LockResource LoadResource FindResourceW FindResourceExW SystemTimeToFileTime LoadLibraryW GetModuleHandleA GetCurrentProcess EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetLastError CloseHandle WideCharToMultiByte MultiByteToWideChar lstrlenA lstrlenW MoveFileExW GetTempFileNameW GetTempPathW DeleteFileW MoveFileW WriteFile ReadFile GetFileSize CreateFileW SetFileAttributesW Sleep CreateProcessW GetModuleFileNameW GetComputerNameA GetSystemTime HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException InitializeCriticalSectionAndSpinCount LocalAlloc SetEndOfFile WriteConsoleW SetStdHandle GetStringTypeW InterlockedExchange GetCommandLineW HeapSetInformation GetStartupInfoW RtlUnwind GetCurrentThreadId EncodePointer DecodePointer SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers FreeLibrary

ole32

CoCreateInstance CoInitialize

shell32

SHGetSpecialFolderPathW ShellExecuteW

shlwapi

PathAddExtensionW PathAppendW PathFileExistsW PathIsRootW PathRemoveExtensionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_8940580681db662a40ac29f841fc8827_amadey_elex_remcos_rhadamanthys_smoke-loader

kernel32

ole32

shell32

shlwapi

generic