C:\fowoxalecobaveciwuyo\ciyelijehijo.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-24_44e50be992352341e96724b070f13a16_karagany_rhadamanthys_smoke-loader.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
2025-03-24_44e50be992352341e96724b070f13a16_karagany_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-03-24_44e50be992352341e96724b070f13a16_karagany_rhadamanthys_smoke-loader
-
Size
97KB
-
MD5
44e50be992352341e96724b070f13a16
-
SHA1
8e818aa8cb6f3bb05950b96940e8ff6be8a4f466
-
SHA256
42e68bf8d713e8c1f3248974a4a7ff66888a71986d9df655c582b074182c69d2
-
SHA512
69c1443e9d542a21803885e45156b14053e4a7d97ccbe457d95a5c285d52c0fa7a39d1c6817d66cea20d40533f78cbb668955b143410e675c01a8351abed933c
-
SSDEEP
1536:+j8FH3uZGcivReMM6jeDO50qMzbumUQ38ggHxa/:+2eZGciZeQSDYM2mr3Y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-03-24_44e50be992352341e96724b070f13a16_karagany_rhadamanthys_smoke-loader
Files
-
2025-03-24_44e50be992352341e96724b070f13a16_karagany_rhadamanthys_smoke-loader.exe windows:5 windows x86 arch:x86
26a4c22526fca0f8a28827f17c3740d0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FindActCtxSectionStringA
GlobalAlloc
GetConsoleMode
CreateEventA
WriteConsoleW
TerminateProcess
lstrcatA
GetStringTypeExA
GetProcAddress
GetProcessHeaps
GetNumaHighestNodeNumber
LoadLibraryA
RegisterWaitForSingleObjectEx
QueryDosDeviceW
SetProcessWorkingSetSize
FindFirstChangeNotificationA
UpdateResourceW
PurgeComm
DeleteFileW
GetTickCount
SetEvent
_lwrite
LoadResource
SetEndOfFile
EnumDateFormatsExW
GetNumaNodeProcessorMask
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
WriteFile
WideCharToMultiByte
GetConsoleCP
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
GetStdHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
TlsGetValue
TlsSetValue
InterlockedIncrement
GetModuleHandleW
SetLastError
GetCurrentThreadId
InterlockedDecrement
SetStdHandle
FlushFileBuffers
IsProcessorFeaturePresent
Sleep
HeapFree
ExitProcess
RtlUnwind
CreateFileW
CloseHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
GetModuleFileNameW
HeapAlloc
LoadLibraryW
LCMapStringW
user32
GetCaretPos
advapi32
AccessCheckByTypeResultList
AddAuditAccessAce
DestroyPrivateObjectSecurity
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xac Size: 10KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ