2026-08-09_7ca8a96e8619553f62b833ee593ef250_amadey_elex_remcos_rhadamanthys_smoke-loader_stop

General

Target
2026-08-09_7ca8a96e8619553f62b833ee593ef250_amadey_elex_remcos_rhadamanthys_smoke-loader_stop
Size 14.7MB
Sample260809-hgfpmssemc
SHA256 e5d446d32b31436195100a96d1af8d75bb20c600d2f103805919ef34818d6fbd
MD5 7ca8a96e8619553f62b833ee593ef250
SHA1 f4f57c7ae9098edd3aaf5401b4388cc6bb9361b1
SHA512 4e99b14b77b11d3268330e67fd209af1409b53ea001dcd9a948473e27493e5380f6c0bc3ba14878e128bec66b3f85e374bb33940b403f3d6b991be780ea2d412
SSDEEP 196608:qzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzj:
TLSH
T1BCF6F7E1DEA07BCDE7220E709A1ACBE467DDB950DA246A1B120CED0F297C761C51F721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_7ca8a96e8619553f62b833ee593ef250_amadey_elex_remcos_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-09_7ca8a96e8619553f62b833ee593ef250_amadey_elex_remcos_rhadamanthys_smoke-loader_stop

.exe 14.7MB

2026-08-09_7ca8a96e8619553f62b833ee593ef250_amadey_elex_remcos_rhadamanthys_smoke-loader_stop

IMPHASH 1b0af0470af4d888c83defee61420444
SHA256 e5d446d32b31436195100a96d1af8d75bb20c600d2f103805919ef34818d6fbd
MD5 7ca8a96e8619553f62b833ee593ef250
SHA1 f4f57c7ae9098edd3aaf5401b4388cc6bb9361b1
SHA512 4e99b14b77b11d3268330e67fd209af1409b53ea001dcd9a948473e27493e5380f6c0bc3ba14878e128bec66b3f85e374bb33940b403f3d6b991be780ea2d412
SSDEEP 196608:qzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzj:
TLSH
T1BCF6F7E1DEA07BCDE7220E709A1ACBE467DDB950DA246A1B120CED0F297C761C51F721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7766

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EnumCalendarInfoA TryEnterCriticalSection VirtualQuery GetConsoleAliasExesLengthA SetDefaultCommConfigW HeapFree UnlockFile FreeEnvironmentStringsA GetModuleHandleW FindNextVolumeMountPointA GetConsoleAliasesLengthA GetDateFormatA SetCommState GetConsoleCP GlobalAlloc LoadLibraryW HeapReAlloc IsBadWritePtr GetAtomNameW GetModuleFileNameW SetCurrentDirectoryA GetCurrentDirectoryW GetLongPathNameW GetProcAddress FindVolumeMountPointClose GetProcessHeaps LoadLibraryA WaitForMultipleObjects CreatePipe SetConsoleTitleW SetCalendarInfoA CloseHandle CreateFileW GetLocaleInfoW GetComputerNameA GetLastError GetCommandLineW HeapSetInformation GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DecodePointer EncodePointer HeapAlloc IsProcessorFeaturePresent HeapCreate ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep RtlUnwind HeapSize SetStdHandle WriteConsoleW MultiByteToWideChar LCMapStringW GetStringTypeW FlushFileBuffers

user32

LoadIconW

advapi32

ReadEventLogW

ole32

CoTaskMemFree

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_7ca8a96e8619553f62b833ee593ef250_amadey_elex_remcos_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

ole32

generic