General
- Target 2026-09-12_da67d4b0f2219ebb231848193d609294_amadey_elex_hammertoss_njrat_remcos_smoke-loader_swisyn
- Size 4.5MB
- Sample260912-ty8brsbr71
- SHA256 e3e4273a4f53d1fe28c61747b1f4bec9b260d8bc1675aadc6f91113c0193c83f
- MD5 da67d4b0f2219ebb231848193d609294
- SHA1 ad7283f124dcc74fca7b10048f0ba0473a3325bf
- SHA512 d5d4ca9987c664d459cc83b363b23517a8e0ea92ad47f03f2a81c7db9d47ffb72f20174b257679885e8b4de1d0d4a291c37618e7648dbbd071c45d0b2e0e206c
- SSDEEP 98304:DJm0DOcYONcCqc+adUwJcDd5MBTetnWj3A+PkFhHwgYncUdx6:17DOHUz3JUd5+etu3uWjfP6
- TLSH T1F226022332248075E4EB8CB9453BBFB572F61B364B81BCFB61DA7DC925350D1A226643
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-12_da67d4b0f2219ebb231848193d609294_amadey_elex_hammertoss_njrat_remcos_smoke-loader_swisyn.exe
Resource
win10v2004-20260911-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-12_da67d4b0f2219ebb231848193d609294_amadey_elex_hammertoss_njrat_remcos_smoke-loader_swisyn.exe
Resource
win11ltsc2024-20260911-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-12_da67d4b0f2219ebb231848193d609294_amadey_elex_hammertoss_njrat_remcos_smoke-loader_swisyn
- Size 4.5MB
- SHA256 e3e4273a4f53d1fe28c61747b1f4bec9b260d8bc1675aadc6f91113c0193c83f
- MD5 da67d4b0f2219ebb231848193d609294
- SHA1 ad7283f124dcc74fca7b10048f0ba0473a3325bf
- SHA512 d5d4ca9987c664d459cc83b363b23517a8e0ea92ad47f03f2a81c7db9d47ffb72f20174b257679885e8b4de1d0d4a291c37618e7648dbbd071c45d0b2e0e206c
- SSDEEP 98304:DJm0DOcYONcCqc+adUwJcDd5MBTetnWj3A+PkFhHwgYncUdx6:17DOHUz3JUd5+etu3uWjfP6
- TLSH T1F226022332248075E4EB8CB9453BBFB572F61B364B81BCFB61DA7DC925350D1A226643
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Detects executables packed with VMProtect.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory