2025-03-20_a6ee68a3af1a97be5140f8bbe8e1951f_amadey_rhadamanthys_sakula_smoke-loader

Sharing

Copy URL

Twitter E-mail

General

Target

2025-03-20_a6ee68a3af1a97be5140f8bbe8e1951f_amadey_rhadamanthys_sakula_smoke-loader
Size

537KB
MD5

a6ee68a3af1a97be5140f8bbe8e1951f
SHA1

ab464d5c1b4805ba26b9aabdd4befca1c7638ce7
SHA256

4eb1537b1b1fac89e3a5b1c40b80500a6385e3a3601ec903971d88fa00740232
SHA512

1030706251ab9b806dd52e5d012e3daeaaab707465dafca0fb2382ae2d0a69764361b0904da36dea9df855f5f6563dd6233f9a5f68b490e141307915e24938b9
SSDEEP

6144:Vel/lJDNV7o6kIhrse2oHb9/SWGkI/MXYmNsdpjL0Dba9hO5EbDM0/:MZD7bkIB5kjM/sEoO5EbDt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-03-20_a6ee68a3af1a97be5140f8bbe8e1951f_amadey_rhadamanthys_sakula_smoke-loader

Files

2025-03-20_a6ee68a3af1a97be5140f8bbe8e1951f_amadey_rhadamanthys_sakula_smoke-loader
.exe windows:5 windows x86 arch:x86

5d7b93d08d190770e760b272506bac79

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\nifakukozut-bex koxade\21_rahi.pdb

Imports

kernel32

SetTapePosition
WriteTapemark
GetConsoleAliasesA
WriteConsoleW
SetLastError
CreateFileA
DeleteFileA
WritePrivateProfileSectionA
GetPrivateProfileSectionW
WriteProfileSectionW
RequestDeviceWakeup
LoadLibraryW
FlushFileBuffers
GetLongPathNameA
ReadFile
WriteFile
GetProfileSectionA
BuildCommDCBA
FindActCtxSectionGuid
SetEndOfFile
SetFileShortNameA
WriteProcessMemory
GetFileAttributesA
SetTapeParameters
PulseEvent
SleepEx
WaitForSingleObject
WaitForMultipleObjects
AllocConsole
ReadConsoleW
ReleaseActCtx
GetProcessHeap
BuildCommDCBAndTimeoutsW
GetGeoInfoW
GetCurrentProcess
GetProcAddress
GetModuleHandleW
HeapUnlock
GetOEMCP
WaitForMultipleObjectsEx
SetSystemPowerState
FindAtomW
CreateJobObjectW
HeapValidate
GetDiskFreeSpaceA
WriteConsoleInputA
ReadConsoleInputA
GetCPInfoExW
ZombifyActCtx
GetUserDefaultLCID
SetEvent
GetConsoleAliasesLengthA
CloseHandle
GetCommandLineA
GetStartupInfoA
GetLastError
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetStdHandle
GetConsoleCP
GetConsoleMode
RtlUnwind
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
IsValidCodePage
MultiByteToWideChar
LoadLibraryA
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

user32

GetAltTabInfoW

gdi32

GetCharWidth32A

advapi32

AdjustTokenPrivileges
MapGenericMask
AreAnyAccessesGranted
AdjustTokenGroups

winhttp

WinHttpSetOption

Exports

Exports

@GetVice@0

Sections

.text
Size: 373KB - Virtual size: 373KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

oqmYFWah
Size: 2KB - Virtual size: 2KB

gqTzdrHO
Size: 1KB - Virtual size: 1KB

bdlUgUwP
Size: 45KB - Virtual size: 44KB

OBjTQuTc
Size: 1024B - Virtual size: 990B

QSxSzbUE
Size: 2KB - Virtual size: 1KB

UanOfLMU
Size: 512B - Virtual size: 350B

BBIQHLdq
Size: 40KB - Virtual size: 39KB

YRHdITVt
Size: 2KB - Virtual size: 1KB

sOMetvJb
Size: 23KB - Virtual size: 22KB

ZtcZmTtb
Size: 2KB - Virtual size: 2KB

Sharing

General

Malware Config

Signatures

Files

5d7b93d08d190770e760b272506bac79

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

winhttp

Exports

Exports

Sections

.text Size: 373KB - Virtual size: 373KB

.data Size: 18KB - Virtual size: 5.5MB

.rsrc Size: 24KB - Virtual size: 23KB

oqmYFWah Size: 2KB - Virtual size: 2KB

gqTzdrHO Size: 1KB - Virtual size: 1KB

bdlUgUwP Size: 45KB - Virtual size: 44KB

OBjTQuTc Size: 1024B - Virtual size: 990B

QSxSzbUE Size: 2KB - Virtual size: 1KB

UanOfLMU Size: 512B - Virtual size: 350B

BBIQHLdq Size: 40KB - Virtual size: 39KB

YRHdITVt Size: 2KB - Virtual size: 1KB

sOMetvJb Size: 23KB - Virtual size: 22KB

ZtcZmTtb Size: 2KB - Virtual size: 2KB

.text
Size: 373KB - Virtual size: 373KB

.data
Size: 18KB - Virtual size: 5.5MB

.rsrc
Size: 24KB - Virtual size: 23KB

oqmYFWah
Size: 2KB - Virtual size: 2KB

gqTzdrHO
Size: 1KB - Virtual size: 1KB

bdlUgUwP
Size: 45KB - Virtual size: 44KB

OBjTQuTc
Size: 1024B - Virtual size: 990B

QSxSzbUE
Size: 2KB - Virtual size: 1KB

UanOfLMU
Size: 512B - Virtual size: 350B

BBIQHLdq
Size: 40KB - Virtual size: 39KB

YRHdITVt
Size: 2KB - Virtual size: 1KB

sOMetvJb
Size: 23KB - Virtual size: 22KB

ZtcZmTtb
Size: 2KB - Virtual size: 2KB