2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi
Size 32.6MB
Sample260710-qmr9mact21
SHA256 0bd27066ee8499ca6a5ad00837f103a2aab76d500405107d04c7f5861a380f3d
MD5 d4c9594294c6ec389e32d47ac59dd23e
SHA1 63b32fade97d90abf33ccc8439fc86f876c00ce2
SHA512 bafdc7d9b9cf3f0115737d918494c15fb39532a6b0963ab43abdda08ba23f9d3f040136c9d2869d756e85e8b41d28c7adb1dd77a896a1f3ed87eb171bc822b4a
SSDEEP 786432:pxSGhDSNESwjGivU44UnZjW9ACajPw0A63ib/DDo9k:2WGR44iK9ACajPBR3ib/Q
TLSH
T1C87733803A94C6B3D455033550579B82BFE69C45F918CF0E72C2B0B93EF66998A772CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi

File Explorer

2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi

.exe 32.6MB

2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi

IMPHASH 4919594d07b5897f2c5f632270759675
SHA256 0bd27066ee8499ca6a5ad00837f103a2aab76d500405107d04c7f5861a380f3d
MD5 d4c9594294c6ec389e32d47ac59dd23e
SHA1 63b32fade97d90abf33ccc8439fc86f876c00ce2
SHA512 bafdc7d9b9cf3f0115737d918494c15fb39532a6b0963ab43abdda08ba23f9d3f040136c9d2869d756e85e8b41d28c7adb1dd77a896a1f3ed87eb171bc822b4a
SSDEEP 786432:pxSGhDSNESwjGivU44UnZjW9ACajPw0A63ib/DDo9k:2WGR44iK9ACajPBR3ib/Q
TLSH
T1C87733803A94C6B3D455033550579B82BFE69C45F918CF0E72C2B0B93EF66998A772CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34275328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

WSACleanup WSAStartup socket htons connect WSAAsyncSelect WSAGetLastError shutdown recv setsockopt send closesocket ioctlsocket gethostbyname

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

kernel32

GetVersionExA lstrcmpiA lstrcatA lstrcpyA lstrlenA _lwrite SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime _lclose GetProcAddress LoadLibraryA _lcreat GetPrivateProfileStringA GetPrivateProfileIntA GlobalLock GlobalAlloc GlobalFree GlobalUnlock WritePrivateProfileStringA GetSystemDirectoryA GetTempFileNameA GetTempPathA FreeLibrary DeleteFileA _llseek lstrcmpA _lread GetCommandLineA CloseHandle GetFileTime CreateFileA FreeResource LockResource LoadResource SizeofResource FindResourceA GetFileAttributesA ExitProcess _lopen GetExitCodeProcess WaitForSingleObject GetModuleFileNameA CreateDirectoryA SetErrorMode MulDiv GetUserDefaultLangID SetCurrentDirectoryA GetCurrentProcess ExpandEnvironmentStringsA Sleep GetFileSize SetEnvironmentVariableA GetModuleHandleA lstrcpynA

user32

DispatchMessageA TranslateMessage PeekMessageA wsprintfA GetDC MessageBoxA DestroyWindow CharNextA LoadStringA SendMessageA GetDlgItem EnumChildWindows ReleaseDC EndDialog GetDlgItemTextA SetWindowTextA SetDlgItemTextA CreateDialogParamA ExitWindowsEx EnableWindow ShowWindow SetTimer DialogBoxParamA

gdi32

GetDeviceCaps DeleteObject CreateFontA

advapi32

RegCreateKeyExA RegDeleteValueA RegEnumValueA OpenSCManagerA CloseServiceHandle OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegQueryValueExA RegSetValueExA RegQueryValueA RegOpenKeyExA RegCloseKey

shell32

ShellExecuteExA

Name

.text

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

1KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.WISE

Size

32.5MB

Virtual Size

32.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

?G�u�

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_d4c9594294c6ec389e32d47ac59dd23e_amadey_elex_rhadamanthys_smoke-loader_stop_wapomi

wsock32

version

kernel32

user32

gdi32

advapi32

shell32

generic