2026-06-30_14e955321f3059b74c597c642dfb405f_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-06-30_14e955321f3059b74c597c642dfb405f_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee
Size 1.4MB
Sample260701-awz3tsc19w
SHA256 bd621cf518803ba3143044f517c5a5dfe3d8aadfb3d19d3a25e140b20c0b7d2b
MD5 14e955321f3059b74c597c642dfb405f
SHA1 f75258fa4e17c82ef4768b6731e8e5007a576332
SHA512 b5aad0ad26507f20cadc3152334a086291cc05c0abe0f5d7bedbdeebc4cf8fe01a242c3667e545797bc416bca4932973678bc4d35115d7c9d49a0e39a8710e13
SSDEEP 24576:akMVL+MUVOY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:PMJ+pO/Jz83Zxq0JXh6k/
TLSH
T18865023472C0D0B2E053113146A5CBF14EB9BCB27321A8DF77D91679AF346A4A6387AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_14e955321f3059b74c597c642dfb405f_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-06-30_14e955321f3059b74c597c642dfb405f_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

.exe 1.4MB

2026-06-30_14e955321f3059b74c597c642dfb405f_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH ba6e7d1028cd73d291b266f23866459e
SHA256 bd621cf518803ba3143044f517c5a5dfe3d8aadfb3d19d3a25e140b20c0b7d2b
MD5 14e955321f3059b74c597c642dfb405f
SHA1 f75258fa4e17c82ef4768b6731e8e5007a576332
SHA512 b5aad0ad26507f20cadc3152334a086291cc05c0abe0f5d7bedbdeebc4cf8fe01a242c3667e545797bc416bca4932973678bc4d35115d7c9d49a0e39a8710e13
SSDEEP 24576:akMVL+MUVOY0Juaz83ZxXVk3MHJlNh6k3QGjdQ:PMJ+pO/Jz83Zxq0JXh6k/
TLSH
T18865023472C0D0B2E053113146A5CBF14EB9BCB27321A8DF77D91679AF346A4A6387AD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

36058

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\b\HTE\QDART\QDART_MFG\BSP_Storage\QSaharaServer\Release\QSaharaServer.pdb

kernel32

CloseHandle SetCommTimeouts CreateFileA WriteFile ReadFile Sleep GetTickCount GetSystemInfo GetSystemTimeAsFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetLastError GetFileType FindClose GetDriveTypeA FindFirstFileExA GetFileAttributesA EnterCriticalSection LeaveCriticalSection GetProcAddress GetModuleHandleW ExitProcess DecodePointer SetFilePointer GetCommandLineA HeapSetInformation TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer IsProcessorFeaturePresent WideCharToMultiByte GetTimeZoneInformation SetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetStartupInfoW DeleteCriticalSection GetFullPathNameA HeapFree GetCurrentDirectoryW SetCurrentDirectoryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread GetConsoleCP GetConsoleMode SetEndOfFile HeapAlloc GetProcessHeap MultiByteToWideChar InterlockedExchange FatalAppExitA SetConsoleCtrlHandler FreeLibrary LoadLibraryW GetLocaleInfoW GetModuleFileNameW HeapSize HeapQueryInformation HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetCurrentProcessId RtlUnwind GetDriveTypeW LCMapStringW WriteConsoleW FlushFileBuffers GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CreateFileW CompareStringW SetEnvironmentVariableA CreateDirectoryA

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_14e955321f3059b74c597c642dfb405f_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

generic