2026-08-09_b5f99a23c0ed950572b267513ba6a72b_amadey_elex_remcos_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_b5f99a23c0ed950572b267513ba6a72b_amadey_elex_remcos_rhadamanthys_smoke-loader_stop
Size 1.5MB
Sample260809-q3rm2ayeng
SHA256 c43326837345fb6325dfc4a87d6b07ac956193c11e463e8db3421784e1840d42
MD5 b5f99a23c0ed950572b267513ba6a72b
SHA1 9089d566b7b23ab1215739392b20993cbc4562e5
SHA512 4b6ac60043d45a9a3128380c3ce18fc496e664c39855898f533e39b28b9d980108f9a2c5d4ad3c00dce84116a02553a51aae3ec7e8c2b961e9244983eb950f7a
SSDEEP 24576:WdMof7apFrP6GquK958bQGTWFm/WeE1UmtlENv1:WdMzpFb+uE58bFaM/WeE2mnENd
TLSH
T14965E021B3D4D076D2B335724A6AE6B859AEBC315F31438B37C02B2D5E345D29A3871B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_b5f99a23c0ed950572b267513ba6a72b_amadey_elex_remcos_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-09_b5f99a23c0ed950572b267513ba6a72b_amadey_elex_remcos_rhadamanthys_smoke-loader_stop

.exe 1.5MB

2026-08-09_b5f99a23c0ed950572b267513ba6a72b_amadey_elex_remcos_rhadamanthys_smoke-loader_stop

IMPHASH a1b5857cebe49aaf6e95ab17307710d0
SHA256 c43326837345fb6325dfc4a87d6b07ac956193c11e463e8db3421784e1840d42
MD5 b5f99a23c0ed950572b267513ba6a72b
SHA1 9089d566b7b23ab1215739392b20993cbc4562e5
SHA512 4b6ac60043d45a9a3128380c3ce18fc496e664c39855898f533e39b28b9d980108f9a2c5d4ad3c00dce84116a02553a51aae3ec7e8c2b961e9244983eb950f7a
SSDEEP 24576:WdMof7apFrP6GquK958bQGTWFm/WeE1UmtlENv1:WdMzpFb+uE58bFaM/WeE2mnENd
TLSH
T14965E021B3D4D076D2B335724A6AE6B859AEBC315F31438B37C02B2D5E345D29A3871B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

139140

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\Administrator\SoftwareUpdater\Ryoga\MSIKicker\MSIKicker\Results\Setup.pdb

msi

ord45 ord70

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

kernel32

DuplicateHandle GetVolumeInformationW GetFullPathNameW CreateFileW SetErrorMode GetTickCount GetFileSizeEx GetFileTime GetStartupInfoW HeapAlloc HeapFree RtlUnwind RaiseException HeapReAlloc ExitProcess ExitThread CreateThread HeapSize VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetConsoleCP GetFileSize LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetCurrentDirectoryA GetDriveTypeA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA GetModuleFileNameW GetFileAttributesW GetVersionExW SizeofResource LockResource LoadResource FindResourceW GlobalAlloc GlobalFree GetPrivateProfileStringW GetProcAddress GetModuleHandleW GetCurrentProcess SetLastError ExpandEnvironmentStringsW GetUserDefaultLangID GetUserDefaultLCID GetStringTypeExW GetSystemDefaultLCID Sleep SuspendThread ResumeThread GetExitCodeThread WaitForSingleObject GetExitCodeProcess CloseHandle OpenProcess WTSGetActiveConsoleSessionId MulDiv lstrlenW SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile WritePrivateProfileStringW GlobalFlags GetThreadLocale TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedIncrement GetModuleHandleA lstrlenA CreateEventW SetEvent SetThreadPriority GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom LoadLibraryW CompareStringW LoadLibraryA lstrcmpW GetVersionExA FreeResource GetCurrentProcessId FindFirstFileW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW FindClose FreeLibrary InterlockedDecrement WideCharToMultiByte MultiByteToWideChar GetLastError GlobalLock GlobalUnlock FormatMessageW LocalFree GetConsoleMode

user32

RegisterClipboardFormatW PostThreadMessageW UnregisterClassW LoadCursorW GetSysColorBrush EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW DestroyMenu SetCursor GetMessageW GetCursorPos ValidateRect SetWindowContextHelpId MapDialogRect PostQuitMessage ShowWindow MoveWindow SetWindowTextW IsDialogMessageW RegisterWindowMessageW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW SetFocus GetWindowTextW GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints GetKeyState SetMenu SetForegroundWindow IsWindowVisible UpdateWindow PostMessageW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx EqualRect GetDlgCtrlID DefWindowProcW CallWindowProcW CopyRect PtInRect GetMenu SetWindowLongW EnableWindow KillTimer SetTimer MsgWaitForMultipleObjects PeekMessageW SetWindowPos OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindow GetWindowRect GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetDlgItem GetNextDlgTabItem CharUpperW MessageBeep GetNextDlgGroupItem InvalidateRgn InvalidateRect CopyAcceleratorTableW SetRect IsRectEmpty CharNextW EndDialog GetWindowLongW ReleaseCapture SetCapture RemovePropW TranslateMessage DispatchMessageW FindWindowW GetWindowThreadProcessId LoadIconW GetSystemMenu AppendMenuW SendMessageW IsIconic GetSystemMetrics GetClientRect DrawIcon GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState UnhookWindowsHookEx CheckMenuItem EnableMenuItem ModifyMenuW GetParent GetFocus LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps MessageBoxW IsWindowEnabled GetLastActivePopup SetWindowsHookExW

gdi32

SetMapMode DeleteObject GetViewportExtEx GetWindowExtEx PtVisible RectVisible TextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx ScaleViewportExtEx RestoreDC SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC GetStockObject GetBkColor GetTextColor CreateRectRgnIndirect GetRgnBox GetMapMode SaveDC ExtTextOutW GetObjectW SetBkColor SetTextColor GetClipBox CreateBitmap SetViewportExtEx GetDeviceCaps

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegQueryValueExW RegSetValueExW RegCreateKeyExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW SetTokenInformation DuplicateTokenEx OpenProcessToken RegCloseKey RegOpenKeyExW

shell32

ShellExecuteExW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW PathStripToRootW PathIsUNCW PathFindExtensionW

oledlg

OleUIBusyW

ole32

OleUninitialize CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CLSIDFromProgID CoFreeUnusedLibraries CoTaskMemAlloc CoTaskMemFree OleInitialize CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject

oleaut32

SysStringLen SysFreeString SysAllocStringLen VariantClear VariantChangeType VariantInit VariantCopy SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_b5f99a23c0ed950572b267513ba6a72b_amadey_elex_remcos_rhadamanthys_smoke-loader_stop

msi

userenv

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

generic