2025-04-18_f690a623d4bf63f17e4d584f6ed180f9_amadey_elex_rhadamanthys_smoke-loader[.]exe

General

Target
2025-04-18_f690a623d4bf63f17e4d584f6ed180f9_amadey_elex_rhadamanthys_smoke-loader.exe
Size 14.7MB
Sample250418-pflb3asvht
SHA256 dc5af93785beff1439ac59b0e73ef027ca7c59d11bdbb83a90f24695b7bef2a0
MD5 f690a623d4bf63f17e4d584f6ed180f9
SHA1 1d92c6c50b86f605b2f528eea55baf841297a705
SHA512 8093d167c5d690ca89cf40f935d411c423efb41abd40365731a222899c7b617d75868f9d675b8aa0309ab4bfe1e87434d5507485fb3040c1d53d23e44996b834
SSDEEP 1536:DmcvvNjQ6DGY18ePoODb+kK5jV+7usnYEVFTeP7eeWagO4AazALtWQ41iB94pdrb:JNhDb+kK5xMusYB4a/2TXHMf8WcH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-04-18_f690a623d4bf63f17e4d584f6ed180f9_amadey_elex_rhadamanthys_smoke-loader.exe

File Explorer

2025-04-18_f690a623d4bf63f17e4d584f6ed180f9_amadey_elex_rhadamanthys_smoke-loader.exe

.exe 14.7MB

2025-04-18_f690a623d4bf63f17e4d584f6ed180f9_amadey_elex_rhadamanthys_smoke-loader.exe

IMPHASH 6b0a79bcdd0b6bcc4366f2c9a2a7f250
SHA256 dc5af93785beff1439ac59b0e73ef027ca7c59d11bdbb83a90f24695b7bef2a0
MD5 f690a623d4bf63f17e4d584f6ed180f9
SHA1 1d92c6c50b86f605b2f528eea55baf841297a705
SHA512 8093d167c5d690ca89cf40f935d411c423efb41abd40365731a222899c7b617d75868f9d675b8aa0309ab4bfe1e87434d5507485fb3040c1d53d23e44996b834
SSDEEP 1536:DmcvvNjQ6DGY18ePoODb+kK5jV+7usnYEVFTeP7eeWagO4AazALtWQ41iB94pdrb:JNhDb+kK5xMusYB4a/2TXHMf8WcH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7447

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateEventW DebugBreakProcess GetOverlappedResult VirtualQuery GetProcessWorkingSetSize GlobalFree GetStringTypeExA SetConsoleMode SetEvent UpdateResourceW VirtualProtect FreeEnvironmentStringsW PurgeComm SetCommConfig GetTickCount GetThreadPriority lstrlenW GetSystemWindowsDirectoryA GetCurrentThread GetNumaAvailableMemoryNode DosDateTimeToFileTime GlobalAlloc GlobalUnWire EnumDateFormatsA AllocConsole SetDefaultCommConfigA FlushFileBuffers GetLocalTime GetCurrentThreadId DnsHostnameToComputerNameW ReplaceFileA GetCommandLineA GetVersionExA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType DeleteCriticalSection GetModuleHandleW Sleep GetProcAddress ExitProcess WriteFile GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetLastError GetEnvironmentStringsW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode LoadLibraryA HeapAlloc VirtualAlloc HeapReAlloc LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize CloseHandle CreateFileA

user32

GetCursor

advapi32

RegisterServiceCtrlHandlerA RegEnumKeyA CloseServiceHandle OpenServiceW MapGenericMask IsTokenRestricted RegQueryInfoKeyW SetServiceStatus RegDeleteValueW ClearEventLogA OpenThreadToken GetPrivateObjectSecurity

Sharing