2026-07-04_eb9ce4d8250a5290b24ab91ba7ad7414_amadey_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-07-04_eb9ce4d8250a5290b24ab91ba7ad7414_amadey_elex_rhadamanthys_smoke-loader_stop
Size 660KB
Sample260704-rssb9ags5x
SHA256 f28077b64429b7efee6b9c5dbe5953df65f93debea1c751978d228d2a02c0c05
MD5 eb9ce4d8250a5290b24ab91ba7ad7414
SHA1 8a510f667c717d23087f0dbb97db1142e2bef0c5
SHA512 dd62fa87de027940053d72ad4855aa9b74842dda944beaa0fdb0c15557a78637a605cc7c441c907ff1bc28f9e49c69d3227b1e7c023481937835b244dbf44542
SSDEEP 12288:8mHqfYhVp7J1WrKLmFV5m2xH9uvjP9AXCTnTKUE:8NQlJWKSFV5xQblAXCTnT
TLSH
T168E41216659284B2F34E0BB00A59F9D4868E2D7D64D1F50FF6B87D36A9322E3493B04F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-04_eb9ce4d8250a5290b24ab91ba7ad7414_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-04_eb9ce4d8250a5290b24ab91ba7ad7414_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 660KB

2026-07-04_eb9ce4d8250a5290b24ab91ba7ad7414_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 807c10db7ea63af73a4a95419cfb61e1
SHA256 f28077b64429b7efee6b9c5dbe5953df65f93debea1c751978d228d2a02c0c05
MD5 eb9ce4d8250a5290b24ab91ba7ad7414
SHA1 8a510f667c717d23087f0dbb97db1142e2bef0c5
SHA512 dd62fa87de027940053d72ad4855aa9b74842dda944beaa0fdb0c15557a78637a605cc7c441c907ff1bc28f9e49c69d3227b1e7c023481937835b244dbf44542
SSDEEP 12288:8mHqfYhVp7J1WrKLmFV5m2xH9uvjP9AXCTnTKUE:8NQlJWKSFV5xQblAXCTnT
TLSH
T168E41216659284B2F34E0BB00A59F9D4868E2D7D64D1F50FF6B87D36A9322E3493B04F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6478

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

u:\install\msi\tools\rftmp\release\RFTMP.pdb

kernel32

LocalFree FormatMessageW GetLastError RemoveDirectoryW WaitForSingleObject CloseHandle CreateProcessW CreateDirectoryExW DeleteFileW GetTempFileNameW GetTempPathW GetCommandLineW LCMapStringW LCMapStringA GetFileAttributesW HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsA MultiByteToWideChar GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection LoadLibraryA InitializeCriticalSection Sleep GetCPInfo GetACP GetOEMCP VirtualAlloc HeapReAlloc RtlUnwind HeapSize GetLocaleInfoA WideCharToMultiByte GetStringTypeA GetStringTypeW

user32

MessageBoxW

shell32

SHFileOperationW CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-04_eb9ce4d8250a5290b24ab91ba7ad7414_amadey_elex_rhadamanthys_smoke-loader_stop

kernel32

user32

shell32

generic