2026-10-18_902c10a723b010b8dd61db149e166117_elex_remcos_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-18_902c10a723b010b8dd61db149e166117_elex_remcos_rhadamanthys_smoke-loader_stop
Size 1.3MB
Sample261018-nkakpadt6x
SHA256 32aa9e73b8535fd6f11256f84d4197487323c90b15e21fa9c25ff352e8acdb25
MD5 902c10a723b010b8dd61db149e166117
SHA1 edf2dd08dde0186f5136c2a395ed4a00abfefa6c
SHA512 7d1ee71de667392276bb0aa6ee0b042b8f4a9cb2f7531dd292abb76a2da5683be65660957bd30d04580d45519c07b1d11351568dfb761ade8417a289241d366e
SSDEEP 24576:sAXA5OzE7HyvSwGawTOJT+CUWhOK59kS9tq/CHxm3hURGIsyfhNWB:sAXAcbvSwdwTOJT3P5u4ah0PHgB
TLSH
T11755E100E252A136E4F311F689BFA66D9A786B31030F54E3B3C46E695E21BF17E31257
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-18_902c10a723b010b8dd61db149e166117_elex_remcos_rhadamanthys_smoke-loader_stop

File Explorer

2026-10-18_902c10a723b010b8dd61db149e166117_elex_remcos_rhadamanthys_smoke-loader_stop

.exe 1.3MB

2026-10-18_902c10a723b010b8dd61db149e166117_elex_remcos_rhadamanthys_smoke-loader_stop

IMPHASH a15434d2672da404ca33d42dab490eab
SHA256 32aa9e73b8535fd6f11256f84d4197487323c90b15e21fa9c25ff352e8acdb25
MD5 902c10a723b010b8dd61db149e166117
SHA1 edf2dd08dde0186f5136c2a395ed4a00abfefa6c
SHA512 7d1ee71de667392276bb0aa6ee0b042b8f4a9cb2f7531dd292abb76a2da5683be65660957bd30d04580d45519c07b1d11351568dfb761ade8417a289241d366e
SSDEEP 24576:sAXA5OzE7HyvSwGawTOJT+CUWhOK59kS9tq/CHxm3hURGIsyfhNWB:sAXAcbvSwdwTOJT3P5u4ah0PHgB
TLSH
T11755E100E252A136E4F311F689BFA66D9A786B31030F54E3B3C46E695E21BF17E31257
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

351984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\269435\out\Release\360ScreenCapture.pdb

kernel32

CreateFileA SetEndOfFile SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetStartupInfoA GetFileType SetHandleCount SetFilePointer GetConsoleMode GetConsoleCP ReadFile GetModuleHandleA GetModuleFileNameA GetStdHandle HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo HeapSize ExitProcess Sleep GetStartupInfoW GetSystemTimeAsFileTime HeapReAlloc RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapAlloc GetProcessHeap HeapFree DeleteFileW GlobalLock GlobalUnlock lstrlenA OutputDebugStringW DebugBreak TerminateProcess GlobalAlloc GlobalFree LocalFree CreateFileW WriteFile LocalAlloc FileTimeToLocalFileTime FileTimeToSystemTime GetVersionExW FreeResource LockResource lstrcmpiW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary InitializeCriticalSection GetModuleFileNameW InterlockedIncrement DeleteCriticalSection GetLastError CreateMutexW OpenProcess GetModuleHandleW GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle GetCurrentProcessId GetCommandLineW SetLastError LeaveCriticalSection EnterCriticalSection RaiseException GetCurrentProcess FlushInstructionCache GetCurrentThreadId InterlockedCompareExchange InterlockedDecrement lstrlenW WideCharToMultiByte

user32

LoadCursorW GetClassInfoExW CreateWindowExW SetWindowLongW LoadStringW RegisterClassExW DispatchMessageW ShowWindow GetMessageW DefWindowProcW DestroyWindow CharNextW CallNextHookEx SetWindowsHookExW UnhookWindowsHookEx CharUpperW ReleaseDC GetDC GetSystemMetrics InvalidateRect SendMessageW FillRect InflateRect GetSysColorBrush SetWindowPos GetWindowRect GetClientRect GetParent GetDlgItem BeginPaint EndPaint MessageBoxW TranslateMessage SetRect GetWindowTextW GetWindowLongW PostMessageW SetWindowTextW IntersectRect wsprintfW EqualRect SetFocus GetWindowTextLengthW UnregisterClassA SetCursor ReleaseCapture ScreenToClient DrawTextW UpdateWindow CallWindowProcW wvsprintfW OpenClipboard RedrawWindow CreateDialogParamW EmptyClipboard SetClipboardData CloseClipboard GetWindow PtInRect IsWindowVisible IsRectEmpty IsWindow KillTimer MoveWindow SetTimer GetCursorPos CopyRect GetAsyncKeyState SetClassLongW

gdi32

GetDeviceCaps SelectPalette RealizePalette Ellipse Polygon SetROP2 SetBkMode SetTextColor GetDIBits CreateDCW SaveDC SetMapMode SetViewportOrgEx SetWindowOrgEx MoveToEx LineTo RestoreDC CreateDIBSection CreateCompatibleBitmap GetStockObject CreateSolidBrush CreatePen Rectangle EnumFontFamiliesExW CreateFontW EnumFontFamiliesW CreateCompatibleDC SelectObject BitBlt SetStretchBltMode StretchBlt DeleteDC GetObjectW DeleteObject GetPixel

comdlg32

GetSaveFileNameW

advapi32

RegOpenKeyExW RegDeleteValueW RegCloseKey RegQueryInfoKeyW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize

oleaut32

SysAllocString VarUI4FromStr SysFreeString

shlwapi

PathFindExtensionW StrCmpW StrCmpIW SHGetValueW SHSetValueW PathAddBackslashW PathRemoveFileSpecW

comctl32

_TrackMouseEvent InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipSetClipPath GdipDrawPath GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipAddPathRectangle GdipAddPathLineI GdipDeletePath GdipCreatePath GdipSetPenLineJoin GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen1 GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdipCloneImage GdipDisposeImage GdipFree GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipAlloc GdiplusStartup GdiplusShutdown

psapi

GetModuleFileNameExW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-18_902c10a723b010b8dd61db149e166117_elex_remcos_rhadamanthys_smoke-loader_stop

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

psapi

version

generic