Extracted

• • Target
    2026-04-21_f6efff7448c11756d26b0828666f3db4_amadey_elex_smoke-loader_stop
  • Size 2.3MB
  • SHA256 75c49b2699b53d284a2306d0f648356447b01187b0375211adb301cb5083e29c
  • MD5 f6efff7448c11756d26b0828666f3db4
  • SHA1 fd5ceee5aab122f07bc06e1b0d3b931b20d479d1
  • SHA512 a07ddabbdfeb08d1663fa8987ac8e046fd5fd79a1561721269b2ff324ebb6635702e89a1e2aee7e1cafc8225e591928ab99f12db3d77a7310fb9f5b59993908a
  • SSDEEP 24576:qGmqd9a6ubMYfLqXwsM3wUKAGvMAA2oj58t3sDQeJsEmLvNqSm:qGHa6wzqXhwUAMAx58tcUeqFm
  • TLSH
    T1BFB5B0A6A7989CD6F06B17BC157257678D40BB30082251526CC8ECCF1DAEBD7867C3B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydownloaderlgoogloaderrhadamanthysstealer

  • Detect rhadamanthys stealer shellcode

  • Detects LgoogLoader payload

  • Family: LgoogLoader

    A downloader capable of dropping and executing other malware families.

    downloaderlgoogloader

  • Family: Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detects Windows executables referencing non-Windows User-Agents

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2