2026-05-03_709177316b96e45b5a90a9cd2772037a_elex_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-03_709177316b96e45b5a90a9cd2772037a_elex_rhadamanthys_smoke-loader
Size 371KB
Sample260503-sqjsrsb16w
SHA256 63fc6a559fc908c5e3a45d0ab850a54e310d4019cea3d2cb1d4eb40bf1f72869
MD5 709177316b96e45b5a90a9cd2772037a
SHA1 00c3097982803404220f529dcb575f7cbbbeebb5
SHA512 13832f0c5da43fe47b58cdd39be717872fa9148448ff53c83267a945e70b06beee6c75331e948f799d0e25bbba750909052112ef413d41908f2d87bb5e86d48f
SSDEEP 3072:KI+/+g3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBpg9y5:LAClKgzelZNQSBQGH/CSpWqT/
TLSH
T1B384E1443DA3C473E0424D7189E58BD18B7F6D13BAA2E15FFF590A4B1EB02984BB6361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-03_709177316b96e45b5a90a9cd2772037a_elex_rhadamanthys_smoke-loader

File Explorer

2026-05-03_709177316b96e45b5a90a9cd2772037a_elex_rhadamanthys_smoke-loader

.exe 371KB

2026-05-03_709177316b96e45b5a90a9cd2772037a_elex_rhadamanthys_smoke-loader

IMPHASH 5aa33c577ffd8431ff254de85dee5e7b
SHA256 63fc6a559fc908c5e3a45d0ab850a54e310d4019cea3d2cb1d4eb40bf1f72869
MD5 709177316b96e45b5a90a9cd2772037a
SHA1 00c3097982803404220f529dcb575f7cbbbeebb5
SHA512 13832f0c5da43fe47b58cdd39be717872fa9148448ff53c83267a945e70b06beee6c75331e948f799d0e25bbba750909052112ef413d41908f2d87bb5e86d48f
SSDEEP 3072:KI+/+g3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBpg9y5:LAClKgzelZNQSBQGH/CSpWqT/
TLSH
T1B384E1443DA3C473E0424D7189E58BD18B7F6D13BAA2E15FFF590A4B1EB02984BB6361
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\workplace\c++\hannibal\release\hannibal.pdb

kernel32

CreateFileA GetFileSize FindResourceA SetFilePointer FreeLibrary LoadResource UpdateResourceA SetFileTime WriteFile GetDriveTypeA SizeofResource GetFileAttributesA ReadFile MultiByteToWideChar FindFirstFileA GetLastError CopyFileA SetFileAttributesA FindClose LockResource BeginUpdateResourceA GetModuleFileNameA FindNextFileA LoadLibraryExA EnumResourceNamesA GetFileTime EndUpdateResourceA WinExec CloseHandle DeleteFileA CompareStringW CompareStringA FlushFileBuffers GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP Sleep WideCharToMultiByte GetTimeZoneInformation RaiseException ExitProcess GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA VirtualAlloc HeapReAlloc HeapSize LoadLibraryA InitializeCriticalSection RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA

ole32

CoUninitialize CoCreateInstance CoInitialize

Name

.text

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

988B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.l2

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pad_CER

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pad_RES

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-03_709177316b96e45b5a90a9cd2772037a_elex_rhadamanthys_smoke-loader

kernel32

ole32

generic