2026-07-20_37af29dfe97c177e03d4bca5a719965d_amadey_elex_rhadamanthys_smoke-loader

General

Target
2026-07-20_37af29dfe97c177e03d4bca5a719965d_amadey_elex_rhadamanthys_smoke-loader
Size 876KB
Sample260720-dt3bysdx5p
SHA256 37ec8301c66cdd85606cc31bb05fd9edc429329db310c19a849b37d4e4d8bfa2
MD5 37af29dfe97c177e03d4bca5a719965d
SHA1 039cd44dfb8e7ab558063c6e5e90ec146e436b01
SHA512 b19514d34eaf87d8ce945962eb1f499ad30a6a90e9149e595e6daf1ee5894eead8a3d6c62bf3a73347ce640075f5535ff8535df14880065a0e914a1e3d85edf4
SSDEEP 6144:SPrBEJ24k6m8d4YbcSXiK/9/Kw8p9UIfVdLJI/i/:SPitZm8dBASb/9/K7nvfVdLJI/i/
TLSH
T1CD1529872469CC72C3998336A66906ACD7229C24BE34E79B3513375EFF773C681E1825
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_37af29dfe97c177e03d4bca5a719965d_amadey_elex_rhadamanthys_smoke-loader

File Explorer

2026-07-20_37af29dfe97c177e03d4bca5a719965d_amadey_elex_rhadamanthys_smoke-loader

.exe 876KB

2026-07-20_37af29dfe97c177e03d4bca5a719965d_amadey_elex_rhadamanthys_smoke-loader

IMPHASH 172cc3f52eff7ae08a660a7e2d42c668
SHA256 37ec8301c66cdd85606cc31bb05fd9edc429329db310c19a849b37d4e4d8bfa2
MD5 37af29dfe97c177e03d4bca5a719965d
SHA1 039cd44dfb8e7ab558063c6e5e90ec146e436b01
SHA512 b19514d34eaf87d8ce945962eb1f499ad30a6a90e9149e595e6daf1ee5894eead8a3d6c62bf3a73347ce640075f5535ff8535df14880065a0e914a1e3d85edf4
SSDEEP 6144:SPrBEJ24k6m8d4YbcSXiK/9/Kw8p9UIfVdLJI/i/:SPitZm8dBASb/9/K7nvfVdLJI/i/
TLSH
T1CD1529872469CC72C3998336A66906ACD7229C24BE34E79B3513375EFF773C681E1825
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4761

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\AmericasArmy\ogc_re.exe\Release\ogc_re.exe.pdb

kernel32

VirtualProtectEx Process32Next VirtualProtect CreateToolhelp32Snapshot CloseHandle WriteProcessMemory CreateFileA GetFileSize SetFilePointer GetCurrentProcess WaitForSingleObject CreateRemoteThread VirtualFreeEx Sleep ReadFile GetProcAddress VirtualAllocEx VirtualAlloc GetModuleFileNameA GetModuleHandleA ExitProcess CreateMutexA CreateThread IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter GetSystemInfo FlushFileBuffers LCMapStringW ReadProcessMemory OpenProcess LoadLibraryA Process32First LCMapStringA GetStringTypeW GetSystemTimeAsFileTime GetStartupInfoA GetCommandLineA GetVersionExA HeapReAlloc HeapAlloc TerminateProcess HeapSize TlsAlloc SetLastError GetCurrentThreadId GetLastError TlsFree TlsSetValue TlsGetValue WriteFile GetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapDestroy HeapCreate VirtualFree HeapFree LeaveCriticalSection EnterCriticalSection IsBadWritePtr RtlUnwind InterlockedExchange VirtualQuery GetACP GetOEMCP GetCPInfo InitializeCriticalSection SetStdHandle QueryPerformanceCounter GetTickCount GetCurrentProcessId GetLocaleInfoA GetStringTypeA MultiByteToWideChar

user32

GetMessageA CreateDialogParamA TranslateMessage ShowWindow SetWindowTextA GetWindowThreadProcessId GetWindowModuleFileNameA MessageBoxA FindWindowA DispatchMessageA

advapi32

LookupPrivilegeValueA OpenProcessToken AdjustTokenPrivileges

shell32

Shell_NotifyIconA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_37af29dfe97c177e03d4bca5a719965d_amadey_elex_rhadamanthys_smoke-loader

kernel32

user32

advapi32

shell32

generic