2026-07-16_29c56c8319065f7adb3449e7cb7000f9_amadey_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-07-16_29c56c8319065f7adb3449e7cb7000f9_amadey_elex_rhadamanthys_smoke-loader_stop
Size 3.8MB
Sample260716-e6fjdsc18q
SHA256 b7751ccf4bfcc9473f041ba7af56b96fa39aab15bb3d098d3f6d701dd22c5eeb
MD5 29c56c8319065f7adb3449e7cb7000f9
SHA1 3fb94fd7ff7d74506032e116ad9ddaec61bf7362
SHA512 55095becfe44a08da75f2bfaad1429a97928189a640a0b4d337d5bf7d6d1fb85b3b0399867a09eb23f1f3d52af6a2f6c5a79122800622dc60e9f6b89c422a2bd
SSDEEP 98304:KTHZEOytt+br7ihIV+caKnDPWpFwBTR1A8ICkg:KTHZktMbremV+iDPW3wBFIu
TLSH
T1730633FE2C26A0F3EFA94E7C1E1E498915B4DC02737AC026D65448DAD19628F333D66D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-16_29c56c8319065f7adb3449e7cb7000f9_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-16_29c56c8319065f7adb3449e7cb7000f9_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 3.8MB

2026-07-16_29c56c8319065f7adb3449e7cb7000f9_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 088d01527318a0fbd3989ec82be55fac
SHA256 b7751ccf4bfcc9473f041ba7af56b96fa39aab15bb3d098d3f6d701dd22c5eeb
MD5 29c56c8319065f7adb3449e7cb7000f9
SHA1 3fb94fd7ff7d74506032e116ad9ddaec61bf7362
SHA512 55095becfe44a08da75f2bfaad1429a97928189a640a0b4d337d5bf7d6d1fb85b3b0399867a09eb23f1f3d52af6a2f6c5a79122800622dc60e9f6b89c422a2bd
SSDEEP 98304:KTHZEOytt+br7ihIV+caKnDPWpFwBTR1A8ICkg:KTHZktMbremV+iDPW3wBFIu
TLSH
T1730633FE2C26A0F3EFA94E7C1E1E498915B4DC02737AC026D65448DAD19628F333D66D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables packed with ASPack
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7271

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FreeLibrary GetProcAddress VirtualAlloc LoadLibraryA VirtualFree CloseHandle CreateFileA FindClose LockResource WriteFile SizeofResource FindResourceA lstrlenA LoadResource CreateDirectoryA FindFirstFileA GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError RaiseException GetModuleHandleA ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc Sleep HeapSize InitializeCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind MultiByteToWideChar GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

MessageBoxA

Name

.text

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.aspack

Size

15KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-16_29c56c8319065f7adb3449e7cb7000f9_amadey_elex_rhadamanthys_smoke-loader_stop

kernel32

user32

generic