2026-07-17_51efcedc2038b6f71f7531453e9528bc_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

General

Target
2026-07-17_51efcedc2038b6f71f7531453e9528bc_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee
Size 149KB
Sample260718-ef443afv7r
SHA256 68a6ec8e4e2f58e74c27723e4eb7bfcd8997a6d045a2fd2f7740748da5630c6d
MD5 51efcedc2038b6f71f7531453e9528bc
SHA1 4ac37df55a5f20f914e769c3cbd7a046db8473cf
SHA512 934906fa26fe4b4d12f514a08bd6d4bcb46c5fc8b8f5fcd8617bf8da9205ce7a52f9e5e21070f03e4c56625c0f276598601671b58ecbb0d4e55c41e380389c82
SSDEEP 3072:vbuMGq4hOSOVYjsvB67hdXvasG8oopImQL71yLQE0WRpKRxN:TGq4sHV4s67vSsG3mk1qaWRsbN
TLSH
T14DE3E1257991D8B2D4626AB05D70E2F2EA2F7561237904CF77981FBE1F706C14A3832B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-17_51efcedc2038b6f71f7531453e9528bc_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-07-17_51efcedc2038b6f71f7531453e9528bc_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

.exe 149KB

2026-07-17_51efcedc2038b6f71f7531453e9528bc_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH 0a2b722705899394470a1646c30e74dc
SHA256 68a6ec8e4e2f58e74c27723e4eb7bfcd8997a6d045a2fd2f7740748da5630c6d
MD5 51efcedc2038b6f71f7531453e9528bc
SHA1 4ac37df55a5f20f914e769c3cbd7a046db8473cf
SHA512 934906fa26fe4b4d12f514a08bd6d4bcb46c5fc8b8f5fcd8617bf8da9205ce7a52f9e5e21070f03e4c56625c0f276598601671b58ecbb0d4e55c41e380389c82
SSDEEP 3072:vbuMGq4hOSOVYjsvB67hdXvasG8oopImQL71yLQE0WRpKRxN:TGq4sHV4s67vSsG3mk1qaWRsbN
TLSH
T14DE3E1257991D8B2D4626AB05D70E2F2EA2F7561237904CF77981FBE1F706C14A3832B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

26317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtect MultiByteToWideChar WriteFile CloseHandle ReadFile GetFileSize CreateFileW DeleteFileW CreateProcessW GetCommandLineW GetModuleFileNameW GetCurrentProcessId SetErrorMode HeapReAlloc RaiseException RtlUnwind EncodePointer DecodePointer GetSystemTimeAsFileTime GetLastError HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep HeapSize ExitProcess HeapCreate GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount LeaveCriticalSection EnterCriticalSection LCMapStringW GetStringTypeW LoadLibraryW

user32

ShowWindow UpdateWindow CheckRadioButton IsDialogMessageA RealGetWindowClassW CreateWindowExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_51efcedc2038b6f71f7531453e9528bc_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

kernel32

user32

generic