2026-07-04_10b8e8f94df67f60d678a1c7e66c965c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

General

Target
2026-07-04_10b8e8f94df67f60d678a1c7e66c965c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee
Size 149KB
Sample260704-yemceacz21
SHA256 331eb5c99f03ab73a9b7038d560057606c9ac4bb33a6308201135396b626c4c5
MD5 10b8e8f94df67f60d678a1c7e66c965c
SHA1 96e669af86ee11e831228b090d5026d324128e52
SHA512 647cf43a390ea0ff77855b9b3b657c3008f9cc8b3a3bb1cf29b6ae4eab36fbf2bd10ccbe92514d1c3ea93ab832ddfcdc1dd9ab65ac0937970277b136fe07b21f
SSDEEP 3072:vbuMGq4hOSOVujsvREAlY3RkYoV0SkMY/LpyTSpvboofGqNFz6/:TGq4sHVSUEAlCRkQSkZ/LpKSpQez6
TLSH
T14BE3D0213AD0D872E16326709D74D6B3A92F756257B810C7BB980FBA5E706C14E3836F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-04_10b8e8f94df67f60d678a1c7e66c965c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-07-04_10b8e8f94df67f60d678a1c7e66c965c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

.exe 149KB

2026-07-04_10b8e8f94df67f60d678a1c7e66c965c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH 0a2b722705899394470a1646c30e74dc
SHA256 331eb5c99f03ab73a9b7038d560057606c9ac4bb33a6308201135396b626c4c5
MD5 10b8e8f94df67f60d678a1c7e66c965c
SHA1 96e669af86ee11e831228b090d5026d324128e52
SHA512 647cf43a390ea0ff77855b9b3b657c3008f9cc8b3a3bb1cf29b6ae4eab36fbf2bd10ccbe92514d1c3ea93ab832ddfcdc1dd9ab65ac0937970277b136fe07b21f
SSDEEP 3072:vbuMGq4hOSOVujsvREAlY3RkYoV0SkMY/LpyTSpvboofGqNFz6/:TGq4sHVSUEAlCRkQSkZ/LpKSpQez6
TLSH
T14BE3D0213AD0D872E16326709D74D6B3A92F756257B810C7BB980FBA5E706C14E3836F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

26317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtect MultiByteToWideChar WriteFile CloseHandle ReadFile GetFileSize CreateFileW DeleteFileW CreateProcessW GetCommandLineW GetModuleFileNameW GetCurrentProcessId SetErrorMode HeapReAlloc RaiseException RtlUnwind EncodePointer DecodePointer GetSystemTimeAsFileTime GetLastError HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep HeapSize ExitProcess HeapCreate GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount LeaveCriticalSection EnterCriticalSection LCMapStringW GetStringTypeW LoadLibraryW

user32

ShowWindow UpdateWindow CheckRadioButton IsDialogMessageA RealGetWindowClassW CreateWindowExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-04_10b8e8f94df67f60d678a1c7e66c965c_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

kernel32

user32

generic