shodi | 2026-08-08_784791bd34c5e8c8b8b6044672e4d509_elex_nymaim_remcos_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-08-08_784791bd34c5e8c8b8b6044672e4d509_elex_nymaim_remcos_rhadamanthys_smoke-loader_stealc_tofsee
Size 1.6MB
Sample260808-rt2mbaycmc
SHA256 2bc50324c948a51e5726c6e072fd2d54fccf1dd37d2f6d943ce6c92ae24fceb0
MD5 784791bd34c5e8c8b8b6044672e4d509
SHA1 23637744ecaa68fc43319edaf597667150ff1cbb
SHA512 329182287cd0d029252346092068ec4c64243149aed5f6e6101ef68e852dea494fdeb8d03a8c0fe9283b0c8d585ab2ee04fc69a146a2e6185b5637086e327682
SSDEEP 49152:iIncHMf/lLo51rBmmWOZO9SEmBCp2BDseKECCJY:jV/h4tZNh6
TLSH
T19F754B817484C235E45161BDA9B87DE58568B4A213312DCBFFD03C619A72EC3BE3636B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm shodi

Detects Shodi worm 1 IoCs

resource	yara_rule
sample	family_shodi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_784791bd34c5e8c8b8b6044672e4d509_elex_nymaim_remcos_rhadamanthys_smoke-loader_stealc_tofsee

2026-08-08_784791bd34c5e8c8b8b6044672e4d509_elex_nymaim_remcos_rhadamanthys_smoke-loader_stealc_tofsee

.exe 1.6MB

IMPHASH 77f13bc24efea5a05601b43cf44d1f1a
SHA256 2bc50324c948a51e5726c6e072fd2d54fccf1dd37d2f6d943ce6c92ae24fceb0
MD5 784791bd34c5e8c8b8b6044672e4d509
SHA1 23637744ecaa68fc43319edaf597667150ff1cbb
SHA512 329182287cd0d029252346092068ec4c64243149aed5f6e6101ef68e852dea494fdeb8d03a8c0fe9283b0c8d585ab2ee04fc69a146a2e6185b5637086e327682
SSDEEP 49152:iIncHMf/lLo51rBmmWOZO9SEmBCp2BDseKECCJY:jV/h4tZNh6
TLSH
T19F754B817484C235E45161BDA9B87DE58568B4A213312DCBFFD03C619A72EC3BE3636B
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

15703

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths