2026-07-23_87c547eee92af13689688edec008ce32_elex_karagany_rhadamanthys_smoke-loader

General

Target
2026-07-23_87c547eee92af13689688edec008ce32_elex_karagany_rhadamanthys_smoke-loader
Size 1.4MB
Sample260723-fd8vxadr5x
SHA256 01b62f4ff0c4517ad092a689ddf059f121e79dd661c560ccd9972678fc3bce5e
MD5 87c547eee92af13689688edec008ce32
SHA1 a5a8a8249b2832a229fdc57a891a66c8c7737437
SHA512 8d357ad5f1d640442be3deef6d40e927eefdc759e92e7b02f9c03351e951e5a4641aa42bc7a11af985cee9822fe2a29eac5f8240e39b4cc20b810180e3922c83
SSDEEP 24576:drsll6VA0atr0zAiX90z/F0jsFB3SQk6:U6VA0aB0zj0yjoB2
TLSH
T18E6502013496C0B2C8A307710AF8EA26167DBE714BA25ECF73D92F5E5A341C267357A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_87c547eee92af13689688edec008ce32_elex_karagany_rhadamanthys_smoke-loader

File Explorer

2026-07-23_87c547eee92af13689688edec008ce32_elex_karagany_rhadamanthys_smoke-loader

.exe 1.4MB

2026-07-23_87c547eee92af13689688edec008ce32_elex_karagany_rhadamanthys_smoke-loader

IMPHASH b2958694e69937db330771b2da1ce677
SHA256 01b62f4ff0c4517ad092a689ddf059f121e79dd661c560ccd9972678fc3bce5e
MD5 87c547eee92af13689688edec008ce32
SHA1 a5a8a8249b2832a229fdc57a891a66c8c7737437
SHA512 8d357ad5f1d640442be3deef6d40e927eefdc759e92e7b02f9c03351e951e5a4641aa42bc7a11af985cee9822fe2a29eac5f8240e39b4cc20b810180e3922c83
SSDEEP 24576:drsll6VA0atr0zAiX90z/F0jsFB3SQk6:U6VA0aB0zj0yjoB2
TLSH
T18E6502013496C0B2C8A307710AF8EA26167DBE714BA25ECF73D92F5E5A341C267357A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

29467

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\chencal.AUTH\Documents\MyWork\asg-delivery\BtBHost\WizLocaleLink\Release\WizLocaleLink.pdb

kernel32

GetFileAttributesW GetPrivateProfileStringW SetEndOfFile SetFilePointer CreateFileW GetLastError HeapFree InterlockedDecrement GetCPInfo EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetCommandLineW IsDebuggerPresent IsProcessorFeaturePresent GetProcessHeap HeapAlloc RaiseException InterlockedIncrement MultiByteToWideChar WideCharToMultiByte GetStringTypeW Sleep SetLastError GetCurrentThreadId GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetStartupInfoW ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI WriteFile GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx FlushFileBuffers CloseHandle HeapSize GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW RtlUnwind LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP HeapReAlloc ReadConsoleW LoadLibraryExW SetStdHandle WriteConsoleW OutputDebugStringW LoadLibraryW

user32

wsprintfW

shell32

ShellExecuteW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_87c547eee92af13689688edec008ce32_elex_karagany_rhadamanthys_smoke-loader

kernel32

user32

shell32

generic