2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

General

Target
2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee
Size 149KB
Sample260628-wj2lsaa18j
SHA256 7e48737813037b336ef0b3acbf5a86a073fd7b6bf6e3ca54a63b18e292dc7054
MD5 f41cedd19af2ebd3f536e3688ac30aad
SHA1 f9b5059fa5fa36d384fa1e98214e7f3392ed34b0
SHA512 36eb2f1a97a4e29a3b61df85ae810cb0691b1d71e99b204e755d4d8501534f1dd3683b0ee63be83a6905119afd44e5f28108c3b4663a9bc95022d6cc33532ccb
SSDEEP 3072:vbuMGq4hOSOVOjsvRyp4fo4VYESePOmg+sMCkeoKFaORrzE9hJ:TGq4sHVy2dhJSePOmgtt1DFHRs3J
TLSH
T156E3D0207AA18832D16236705D79D2B2D76B75611BB840CBB7D81FBE5E706C29E3C31E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

.exe 149KB

2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH 0a2b722705899394470a1646c30e74dc
SHA256 7e48737813037b336ef0b3acbf5a86a073fd7b6bf6e3ca54a63b18e292dc7054
MD5 f41cedd19af2ebd3f536e3688ac30aad
SHA1 f9b5059fa5fa36d384fa1e98214e7f3392ed34b0
SHA512 36eb2f1a97a4e29a3b61df85ae810cb0691b1d71e99b204e755d4d8501534f1dd3683b0ee63be83a6905119afd44e5f28108c3b4663a9bc95022d6cc33532ccb
SSDEEP 3072:vbuMGq4hOSOVOjsvRyp4fo4VYESePOmg+sMCkeoKFaORrzE9hJ:TGq4sHVy2dhJSePOmgtt1DFHRs3J
TLSH
T156E3D0207AA18832D16236705D79D2B2D76B75611BB840CBB7D81FBE5E706C29E3C31E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

26317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtect MultiByteToWideChar WriteFile CloseHandle ReadFile GetFileSize CreateFileW DeleteFileW CreateProcessW GetCommandLineW GetModuleFileNameW GetCurrentProcessId SetErrorMode HeapReAlloc RaiseException RtlUnwind EncodePointer DecodePointer GetSystemTimeAsFileTime GetLastError HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep HeapSize ExitProcess HeapCreate GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount LeaveCriticalSection EnterCriticalSection LCMapStringW GetStringTypeW LoadLibraryW

user32

ShowWindow UpdateWindow CheckRadioButton IsDialogMessageA RealGetWindowClassW CreateWindowExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_f41cedd19af2ebd3f536e3688ac30aad_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

kernel32

user32

generic