2026-08-10_5960332510ccb4a3c35550d4ed919def_amadey_elex_remcos_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-08-10_5960332510ccb4a3c35550d4ed919def_amadey_elex_remcos_rhadamanthys_smoke-loader_stealc_tofsee
Size 594KB
Sample260810-h99hesdk91
SHA256 7966160c3419d4f25b42210b1cb508e30b7e40ab1191c4eaea66c53bed53bdbb
MD5 5960332510ccb4a3c35550d4ed919def
SHA1 e88009300941092b6853d617280bd3ef06eb8e12
SHA512 2fa210956aac1363588145ac3f72fa6e12032e518ec673b3ca22f4d9efa35d5782680220ca4c937fbc1205d80d9c6c4b2d0711eca72c19fb5549f956510adc24
SSDEEP 12288:8khAtTauayOXHqPl9h9LuiOfXLyX1tjbi:8l4jDat9fyikyX1t3i
TLSH
T1B7D4BE0352A17C57E7258E328E6F86EC760DB961CD497B763218AE3F28711B2C276731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_5960332510ccb4a3c35550d4ed919def_amadey_elex_remcos_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-08-10_5960332510ccb4a3c35550d4ed919def_amadey_elex_remcos_rhadamanthys_smoke-loader_stealc_tofsee

.exe 594KB

2026-08-10_5960332510ccb4a3c35550d4ed919def_amadey_elex_remcos_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH 76ac311ff3468f282ae83ad43c4ac00e
SHA256 7966160c3419d4f25b42210b1cb508e30b7e40ab1191c4eaea66c53bed53bdbb
MD5 5960332510ccb4a3c35550d4ed919def
SHA1 e88009300941092b6853d617280bd3ef06eb8e12
SHA512 2fa210956aac1363588145ac3f72fa6e12032e518ec673b3ca22f4d9efa35d5782680220ca4c937fbc1205d80d9c6c4b2d0711eca72c19fb5549f956510adc24
SSDEEP 12288:8khAtTauayOXHqPl9h9LuiOfXLyX1tjbi:8l4jDat9fyikyX1t3i
TLSH
T1B7D4BE0352A17C57E7258E328E6F86EC760DB961CD497B763218AE3F28711B2C276731
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12091

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceA GetCPInfo FindResourceW GetConsoleAliasA InterlockedCompareExchange GetComputerNameW GetTickCount GetNumberFormatA GetUserDefaultLangID GlobalAlloc GlobalFindAtomA LoadLibraryW IsBadStringPtrA GetLastError SetLastError GetProcAddress SetFileAttributesA BuildCommDCBW GlobalFree OpenMutexA CreateHardLinkW FindFirstVolumeMountPointW SetConsoleCtrlHandler GetDiskFreeSpaceA EnumResourceTypesW LoadLibraryExA lstrcatW OpenFileMappingW OutputDebugStringA TerminateJobObject GetWindowsDirectoryW WriteProcessMemory HeapFree GetModuleHandleW ExitProcess DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW HeapAlloc HeapCreate InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind Sleep WideCharToMultiByte GetACP GetOEMCP IsValidCodePage HeapSize RaiseException HeapReAlloc IsProcessorFeaturePresent LCMapStringW MultiByteToWideChar GetStringTypeW

user32

GetWindowTextLengthA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_5960332510ccb4a3c35550d4ed919def_amadey_elex_remcos_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

generic