2026-04-15_9a7a0241fb1791f7dba42727ce07fa3e_amadey_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-04-15_9a7a0241fb1791f7dba42727ce07fa3e_amadey_elex_rhadamanthys_smoke-loader_stop
Size 368KB
Sample260415-e15akahz51
SHA256 925a6c3239c010d7338b28cee224b3321a78687d4eec7570c91f4f555d1c009e
MD5 9a7a0241fb1791f7dba42727ce07fa3e
SHA1 481eda726fc24b021e347a19e28be2a520eb6d8c
SHA512 ecd903ad0186a1d017c50b6b97697106ae8b80c4086abc2c476927ee2bd2ed14c86f603d4156d239ae70b6a093b40d7a5c2c45a2ff221a60e071dbf629fd51cb
SSDEEP 6144:s7xbrqwifQDmSAmTTIJ9YY10Abb/Sr2Txj72zltNla40Oq:sF3HprNTTA1dbDRXQQ
TLSH
T14A84D02636D2C936E11AC87D0C05D49D561EBC842FBA2BE377D87F8B4A732C74A35681
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-15_9a7a0241fb1791f7dba42727ce07fa3e_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-04-15_9a7a0241fb1791f7dba42727ce07fa3e_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 368KB

2026-04-15_9a7a0241fb1791f7dba42727ce07fa3e_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 4ffe46f29ef6ead66662a5a3d383b797
SHA256 925a6c3239c010d7338b28cee224b3321a78687d4eec7570c91f4f555d1c009e
MD5 9a7a0241fb1791f7dba42727ce07fa3e
SHA1 481eda726fc24b021e347a19e28be2a520eb6d8c
SHA512 ecd903ad0186a1d017c50b6b97697106ae8b80c4086abc2c476927ee2bd2ed14c86f603d4156d239ae70b6a093b40d7a5c2c45a2ff221a60e071dbf629fd51cb
SSDEEP 6144:s7xbrqwifQDmSAmTTIJ9YY10Abb/Sr2Txj72zltNla40Oq:sF3HprNTTA1dbDRXQQ
TLSH
T14A84D02636D2C936E11AC87D0C05D49D561EBC842FBA2BE377D87F8B4A732C74A35681
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15011

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\This\Time\Path\held\Spring\cotton\areaScience.pdb

ws2_32

connect WSAStartup WSACleanup bind socket closesocket gethostbyaddr accept

kernel32

GetCommandLineW GetDateFormatW LoadResource GetCurrentProcess QueryPerformanceCounter SetEvent GetModuleHandleW GetSystemTimeAsFileTime OpenProcess LoadLibraryW Sleep SetSystemTimeAdjustment GetVersionExW CreateFileW GetLocalTime GetSystemTime GetVolumeInformationW HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoW RaiseException RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsA MultiByteToWideChar GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate VirtualFree GetTickCount GetCurrentProcessId LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP HeapSize LoadLibraryA InitializeCriticalSection LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-15_9a7a0241fb1791f7dba42727ce07fa3e_amadey_elex_rhadamanthys_smoke-loader_stop

ws2_32

kernel32

generic