2026-08-13_7fc189ab2542fd1c13b45fbd06d93b63_amadey_elex_remcos_rhadamanthys_smoke-loader_stealc_stop_virut

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_7fc189ab2542fd1c13b45fbd06d93b63_amadey_elex_remcos_rhadamanthys_smoke-loader_stealc_stop_virut
Size 4.9MB
Sample260813-e3rr9a1hlb
SHA256 50a9003869006a3a474d4d66e4c418c60ba47aefadec3b2b5b01b9556d0fb4f7
MD5 7fc189ab2542fd1c13b45fbd06d93b63
SHA1 b892e8db1435c99b4b840c14d95bb25be40b62df
SHA512 57b7d7ec76149117aac780d2a3c52229549a85fea0e40800896e2ae48b6f6d5473e6670b33309cc896fbb84915365122b02ce60cd3b460124a415f39917f1cc9
SSDEEP 12288:QaA/9qQ5D1fQLa3tw9xGVTNwrntmOQbgzIygTfJhsX2/7FXI4Yf2L/mlLUZS3ID3:6NdAQtwGYrntmOaOIvTBnWrf08LRI89
TLSH
T1F136D0007BE2C0F2D5AA06745D5B9B3A997DF6350B2045E3A3E82F6D3D317C0A67624E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-13_7fc189ab2542fd1c13b45fbd06d93b63_amadey_elex_remcos_rhadamanthys_smoke-loader_stealc_stop_virut

File Explorer

2026-08-13_7fc189ab2542fd1c13b45fbd06d93b63_amadey_elex_remcos_rhadamanthys_smoke-loader_stealc_stop_virut

.exe 4.9MB

2026-08-13_7fc189ab2542fd1c13b45fbd06d93b63_amadey_elex_remcos_rhadamanthys_smoke-loader_stealc_stop_virut

IMPHASH b4a6230a4be9af9394711baeab7944a8
SHA256 50a9003869006a3a474d4d66e4c418c60ba47aefadec3b2b5b01b9556d0fb4f7
MD5 7fc189ab2542fd1c13b45fbd06d93b63
SHA1 b892e8db1435c99b4b840c14d95bb25be40b62df
SHA512 57b7d7ec76149117aac780d2a3c52229549a85fea0e40800896e2ae48b6f6d5473e6670b33309cc896fbb84915365122b02ce60cd3b460124a415f39917f1cc9
SSDEEP 12288:QaA/9qQ5D1fQLa3tw9xGVTNwrntmOQbgzIygTfJhsX2/7FXI4Yf2L/mlLUZS3ID3:6NdAQtwGYrntmOaOIvTBnWrf08LRI89
TLSH
T1F136D0007BE2C0F2D5AA06745D5B9B3A997DF6350B2045E3A3E82F6D3D317C0A67624E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

0e:30:88:65:cc:4f:b5:ae:42:16:fc:a5:93:e9:c3:ac:3d:12:74:eb

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Chains

Apr 3, 2015

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Serial Number

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 11, 2013 - Mar 10, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

5191503

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetLastError FlushInstructionCache CreateRemoteThread WaitForSingleObject WideCharToMultiByte DeleteFileW SetFileAttributesW CreateFileW GetFileSize GetVersionExW DeviceIoControl GetCurrentProcessId InterlockedCompareExchange Sleep ResetEvent SetEvent GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW OpenEventW WaitForMultipleObjects LocalFree GetCommandLineW CreateEventW SetUnhandledExceptionFilter SetErrorMode GetTickCount CreateMutexW GetCurrentProcess TerminateProcess DeleteCriticalSection InitializeCriticalSection LoadLibraryExW FindResourceW LoadResource WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA GetConsoleMode GetConsoleCP SetFilePointer GetModuleHandleA QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize IsValidCodePage GetOEMCP GetACP GetCPInfo InitializeCriticalSectionAndSpinCount GetModuleFileNameA GetStdHandle HeapCreate HeapReAlloc RtlUnwind GetStartupInfoW CreateThread ExitThread IsDebuggerPresent UnhandledExceptionFilter ExitProcess TlsFree DeleteAtom FindAtomW TlsAlloc ReleaseMutex AddAtomW OpenThread GetAtomNameW TlsSetValue TlsGetValue SizeofResource MultiByteToWideChar GetLastError lstrcmpiW GetModuleHandleW InterlockedIncrement GetCurrentThreadId RaiseException CreateProcessW lstrlenA LoadLibraryW GetModuleFileNameW WritePrivateProfileStringW GetTempFileNameW GetTempPathW EnterCriticalSection GetProcAddress FreeLibrary LeaveCriticalSection lstrlenW InterlockedDecrement GetSystemTime FormatMessageW OutputDebugStringW HeapFree GetFileSizeEx ReadFile WriteFile SetFilePointerEx SetEndOfFile LocalFileTimeToFileTime GetSystemTimeAsFileTime SystemTimeToFileTime CreateFileA FreeResource LockResource VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapAlloc GetProcessHeap CloseHandle

user32

BringWindowToTop SetForegroundWindow FindWindowW SetWindowPos SetWindowLongW GetWindowLongW CharNextW ShowWindow DrawTextW SetCursor UpdateLayeredWindow SystemParametersInfoW CopyRect UnregisterClassA DispatchMessageW TranslateMessage MessageBoxW GetActiveWindow LoadStringW PostMessageW SetWindowTextW PtInRect GetCursorPos ReplyMessage PostQuitMessage SetRectEmpty MonitorFromWindow GetMonitorInfoW MapWindowPoints LoadImageW DestroyIcon RegisterWindowMessageW GetWindowTextLengthW ClientToScreen BeginPaint EndPaint IsChild GetFocus GetWindow GetDlgItem IsWindow GetClassNameW GetSysColor RedrawWindow CreateAcceleratorTableW GetWindowTextW ScreenToClient MoveWindow SetCapture ReleaseCapture FillRect InvalidateRgn CallWindowProcW InvalidateRect GetDC ReleaseDC GetDesktopWindow DestroyAcceleratorTable KillTimer SetTimer OffsetRect GetWindowRect IsWindowVisible SetFocus GetClientRect GetParent SendMessageW GetSystemMetrics SendMessageTimeoutW CharLowerW CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW DestroyWindow DefWindowProcW SwitchToThisWindow IsWindowEnabled PeekMessageW GetMessageW

gdi32

SelectObject DeleteObject CreateCompatibleBitmap DeleteDC GetStockObject GetObjectW GetDeviceCaps SetBkMode CreateDIBSection StretchBlt SetStretchBltMode SetTextColor CreateCompatibleDC CreateSolidBrush SaveDC RestoreDC BitBlt

advapi32

RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegQueryValueExW RegQueryValueExA

shell32

SHGetFolderPathW SHGetSpecialFolderPathW CommandLineToArgvW ShellExecuteW SHCreateDirectoryExW

ole32

CoGetClassObject CLSIDFromProgID CreateStreamOnHGlobal OleInitialize OleLockRunning StringFromGUID2 OleUninitialize CoUninitialize CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemRealloc CLSIDFromString CoTaskMemFree

oleaut32

SafeArrayAccessData SafeArrayUnaccessData DispCallFunc OleCreateFontIndirect SysStringLen LoadRegTypeLi LoadTypeLi SafeArrayGetLBound SafeArrayGetUBound VariantClear SysAllocStringLen SysAllocString VariantInit VarUI4FromStr SysFreeString

shlwapi

SHGetValueW PathAppendW PathCombineW PathRemoveFileSpecW StrStrIW PathFileExistsW PathAddExtensionW SHSetValueW PathIsDirectoryW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

InternetSetCookieExW InternetSetOptionW

comctl32

_TrackMouseEvent

msimg32

GradientFill AlphaBlend

Name

.text

Size

301KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

397KB

Virtual Size

396KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_7fc189ab2542fd1c13b45fbd06d93b63_amadey_elex_remcos_rhadamanthys_smoke-loader_stealc_stop_virut

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

wininet

comctl32

msimg32

generic