2026-07-21_5d8ff572c4aeb3eb2dcb2de5a7da6d2b_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

General

Target
2026-07-21_5d8ff572c4aeb3eb2dcb2de5a7da6d2b_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee
Size 149KB
Sample260721-spvtmsbf23
SHA256 75cbbd25be04414a82807d386efac1509355168d6fbf1d6b96bfd331eb67c2a5
MD5 5d8ff572c4aeb3eb2dcb2de5a7da6d2b
SHA1 0be1862187f5af2bcd1781dbf40c356a00a1e500
SHA512 d2d9e5c72c11d10595576a65347d45bb21e505967ece15a5c5c0be5de057424d3ffdb8a7dff02b11684df65db20f032d1f21bd3eae25bdcc1f8444aacfd89f07
SSDEEP 3072:vbuMGq4hOSOVvjsvGmhfL5bUjkSDDGURO2s2L54Ai3gom0/Da:TGq4sHVLPIkSq5L54Ai3gnqe
TLSH
T121E3DF24BA918832E16321705872D6B3A22B75A203B845CF77DD1FBE5F606C05E3D76B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-21_5d8ff572c4aeb3eb2dcb2de5a7da6d2b_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-07-21_5d8ff572c4aeb3eb2dcb2de5a7da6d2b_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

.exe 149KB

2026-07-21_5d8ff572c4aeb3eb2dcb2de5a7da6d2b_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH 0a2b722705899394470a1646c30e74dc
SHA256 75cbbd25be04414a82807d386efac1509355168d6fbf1d6b96bfd331eb67c2a5
MD5 5d8ff572c4aeb3eb2dcb2de5a7da6d2b
SHA1 0be1862187f5af2bcd1781dbf40c356a00a1e500
SHA512 d2d9e5c72c11d10595576a65347d45bb21e505967ece15a5c5c0be5de057424d3ffdb8a7dff02b11684df65db20f032d1f21bd3eae25bdcc1f8444aacfd89f07
SSDEEP 3072:vbuMGq4hOSOVvjsvGmhfL5bUjkSDDGURO2s2L54Ai3gom0/Da:TGq4sHVLPIkSq5L54Ai3gnqe
TLSH
T121E3DF24BA918832E16321705872D6B3A22B75A203B845CF77DD1FBE5F606C05E3D76B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

26317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtect MultiByteToWideChar WriteFile CloseHandle ReadFile GetFileSize CreateFileW DeleteFileW CreateProcessW GetCommandLineW GetModuleFileNameW GetCurrentProcessId SetErrorMode HeapReAlloc RaiseException RtlUnwind EncodePointer DecodePointer GetSystemTimeAsFileTime GetLastError HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep HeapSize ExitProcess HeapCreate GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount LeaveCriticalSection EnterCriticalSection LCMapStringW GetStringTypeW LoadLibraryW

user32

ShowWindow UpdateWindow CheckRadioButton IsDialogMessageA RealGetWindowClassW CreateWindowExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-21_5d8ff572c4aeb3eb2dcb2de5a7da6d2b_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

kernel32

user32

generic