General
- Target 2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.5MB
- Sample260711-e1yssabv9k
- SHA256 cfc61e3ba0b0e0ea4976ea77cfa4f96697008d7e73738fd99daf3d0cadf61c72
- MD5 85447898e31dca120bcef16641494275
- SHA1 0de66c5ec1883acd3f3acae427a46ccd9ae9d2dd
- SHA512 5dfd5fb6d8fa36c6f5f6a2aabc019464542cc781f4652763db6bf21bc02413f0282b68f5adbfcb90d610c8c16d696adab6d294c1f8bb661829c4b114963282e3
- SSDEEP 24576:gk70TrcyeyR9qENt2NaLfGWQYDYV1n0CHOX2ik/1hzSSB+eOnw7pmHP8PMW3Zu6Y:gkQTALyPqRaLfGtz1nGXM1RSSB+Nnw7e
- TLSH T1D67523203A90D133D4B6083581E7DE660A786061A7BAD3D7FB8C2FB56F613D2653A0DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-11_85447898e31dca120bcef16641494275_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.5MB
- SHA256 cfc61e3ba0b0e0ea4976ea77cfa4f96697008d7e73738fd99daf3d0cadf61c72
- MD5 85447898e31dca120bcef16641494275
- SHA1 0de66c5ec1883acd3f3acae427a46ccd9ae9d2dd
- SHA512 5dfd5fb6d8fa36c6f5f6a2aabc019464542cc781f4652763db6bf21bc02413f0282b68f5adbfcb90d610c8c16d696adab6d294c1f8bb661829c4b114963282e3
- SSDEEP 24576:gk70TrcyeyR9qENt2NaLfGWQYDYV1n0CHOX2ik/1hzSSB+eOnw7pmHP8PMW3Zu6Y:gkQTALyPqRaLfGtz1nGXM1RSSB+Nnw7e
- TLSH T1D67523203A90D133D4B6083581E7DE660A786061A7BAD3D7FB8C2FB56F613D2653A0DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with SmartAssembly
-
Detects executables packed with unregistered version of .NET Reactor
-
Detects executables referencing many base64-encoded IR and analysis tools names
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.