2026-07-14_aa9ec1153060267f75c7b35783985f44_amadey_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_aa9ec1153060267f75c7b35783985f44_amadey_elex_rhadamanthys_smoke-loader_stop
Size 846KB
Sample260714-dtxrgads5p
SHA256 913ca5062122f37b22cfcd5ab287bed491c7310dfc64d91b329070086c922ae8
MD5 aa9ec1153060267f75c7b35783985f44
SHA1 fec03d687197e4533a39b778d3958bbfb41090dd
SHA512 14485ad77b464c20e722abeea49d402ff4ebb70c12fdc83fd4b87c48f3e17f0113d3afb32b7c310ee5a4832d039431dddbd3f29376af5bbfe4295cfb490e7a25
SSDEEP 24576:jOo5yT/tMbHWc8eC9TqOUk12+lm/HIpUqph1kVlFo1U:jOowTKbHqlcBInpzkDG
TLSH
T1ED05AE41E7C2D0F1D54610BE01A7A73A1E32BA154315D5CBF2982E969F312F1BA3F39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_aa9ec1153060267f75c7b35783985f44_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-14_aa9ec1153060267f75c7b35783985f44_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 846KB

2026-07-14_aa9ec1153060267f75c7b35783985f44_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH fcba64ab59805c9dd7c85bcc7682c93b
SHA256 913ca5062122f37b22cfcd5ab287bed491c7310dfc64d91b329070086c922ae8
MD5 aa9ec1153060267f75c7b35783985f44
SHA1 fec03d687197e4533a39b778d3958bbfb41090dd
SHA512 14485ad77b464c20e722abeea49d402ff4ebb70c12fdc83fd4b87c48f3e17f0113d3afb32b7c310ee5a4832d039431dddbd3f29376af5bbfe4295cfb490e7a25
SSDEEP 24576:jOo5yT/tMbHWc8eC9TqOUk12+lm/HIpUqph1kVlFo1U:jOowTKbHqlcBInpzkDG
TLSH
T1ED05AE41E7C2D0F1D54610BE01A7A73A1E32BA154315D5CBF2982E969F312F1BA3F39A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

606134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\winapps\gu6\Build\GUBootService\Release\GUBootService.pdb

kernel32

SetEvent GetVersionExW GetCommandLineW GetWindowsDirectoryW OutputDebugStringW DeviceIoControl CreateFileW WriteFile SetFilePointer SetEndOfFile GetFileSize FileTimeToSystemTime FileTimeToLocalFileTime WideCharToMultiByte QueryDosDeviceW lstrlenA LoadLibraryW GetEnvironmentVariableA SystemTimeToFileTime FindClose FindFirstFileW GetStdHandle FlushViewOfFile InterlockedCompareExchange GetProcessHeap OutputDebugStringA WaitForSingleObjectEx UnmapViewOfFile UnlockFileEx UnlockFile ReadFile QueryPerformanceCounter MapViewOfFile LockFileEx LockFile LoadLibraryA HeapCompact HeapValidate HeapSize HeapReAlloc HeapFree LocalFree HeapCreate HeapAlloc GetVersionExA GetTempPathW GetTempPathA GetSystemTimeAsFileTime GetSystemInfo GetFullPathNameW GetFullPathNameA GetFileAttributesExW GetFileAttributesW GetFileAttributesA GetDiskFreeSpaceW GetDiskFreeSpaceA GetCurrentProcessId FormatMessageW FormatMessageA FlushFileBuffers DeleteFileA CreateMutexW CreateFileMappingW CreateFileMappingA CreateFileA AreFileApisANSI TryEnterCriticalSection SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetLocaleInfoA GetCurrentDirectoryA InitializeCriticalSectionAndSpinCount DeleteFileW lstrcpyW GetPrivateProfileStringW lstrcmpW WritePrivateProfileStringW ExpandEnvironmentStringsW WTSGetActiveConsoleSessionId GetSystemTime CreateEventW CreateThread WaitForSingleObject lstrlenW GetCurrentThreadId Sleep GetCurrentProcess CloseHandle GetVersion FindResourceExW LockResource LeaveCriticalSection EnterCriticalSection GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary InterlockedDecrement InterlockedIncrement lstrcmpiW GetModuleHandleW GetProcAddress GetTickCount ProcessIdToSessionId GetLastError DeleteCriticalSection InitializeCriticalSection RaiseException HeapDestroy SetStdHandle GetConsoleMode GetConsoleCP IsValidCodePage GetOEMCP GetACP GetTimeZoneInformation GetModuleHandleA VirtualAlloc VirtualFree SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetCPInfo LCMapStringW LCMapStringA GetDriveTypeA FindNextFileA FindFirstFileA ExitProcess ExitThread RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW

user32

TranslateMessage DispatchMessageW GetMessageW MessageBoxW CharNextW LoadStringW CharUpperW PostThreadMessageW

advapi32

OpenProcessToken StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW LookupAccountNameW ConvertSidToStringSidW RegEnumKeyW DuplicateTokenEx ImpersonateLoggedOnUser CreateProcessAsUserW RevertToSelf ChangeServiceConfigW ChangeServiceConfig2W OpenEventLogW GetOldestEventLogRecord GetNumberOfEventLogRecords ReadEventLogW CloseEventLog RegOpenKeyW ControlService DeleteService CreateServiceW SetServiceStatus RegisterEventSourceW ReportEventW DeregisterEventSource OpenSCManagerW OpenServiceW CloseServiceHandle LookupPrivilegeValueW AdjustTokenPrivileges RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoRevokeClassObject CoCreateInstance CoRegisterClassObject CoInitializeSecurity CoInitialize CoUninitialize StringFromGUID2

shell32

SHGetFolderPathW ord165

oleaut32

SysFreeString VarUI4FromStr SysStringLen LoadRegTypeLi LoadTypeLi VariantTimeToSystemTime SystemTimeToVariantTime VariantInit VariantClear SysAllocString UnRegisterTypeLi RegisterTypeLi SysAllocStringLen

shlwapi

PathMatchSpecW PathFileExistsW SHRegGetPathW

userenv

CreateEnvironmentBlock UnloadUserProfile GetUserProfileDirectoryW LoadUserProfileW DestroyEnvironmentBlock

wtsapi32

WTSQuerySessionInformationW WTSQueryUserToken WTSFreeMemory

pdh

PdhCollectQueryData PdhAddCounterW PdhEnumObjectItemsW PdhOpenQueryW PdhCloseQuery PdhRemoveCounter PdhGetFormattedCounterValue

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_aa9ec1153060267f75c7b35783985f44_amadey_elex_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

userenv

wtsapi32

pdh

generic