2026-07-27_3a3fa2f29403358be9c0268b2c18c153_elex_rhadamanthys_smoke-loader_wapomi

General

Target
2026-07-27_3a3fa2f29403358be9c0268b2c18c153_elex_rhadamanthys_smoke-loader_wapomi
Size 288KB
Sample260727-kgnflaygrf
SHA256 da5c05d33e5d4067031aa0f7fb768dd880333c0cb8167f81ced8dfd78bfae205
MD5 3a3fa2f29403358be9c0268b2c18c153
SHA1 e278d0d5532440f4a081662769e1be28566c2239
SHA512 8491ae97bc96d3669dfd00cf4474e1f2f0d38c03091a14f3a7bfa3eaf0dc69484417a101f21f9be73abc9b7fc9d2612728411e9fd103338c2c3943237b7666e3
SSDEEP 3072:ZgWVRWSq4m1eKD7V89wmnfLSUkYhk9s42TqbVKuh+DEOXpq0q3/5ZVrOjO5OKUOc:zRWSqVmRnfLSokPvVADEO8TBpUm
TLSH
T160546D30E5BE288EFE95D17D963B6FF11D6703D21D1A0AAD229C383D8A7071E39A3115
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_3a3fa2f29403358be9c0268b2c18c153_elex_rhadamanthys_smoke-loader_wapomi

File Explorer

2026-07-27_3a3fa2f29403358be9c0268b2c18c153_elex_rhadamanthys_smoke-loader_wapomi

.exe 288KB

2026-07-27_3a3fa2f29403358be9c0268b2c18c153_elex_rhadamanthys_smoke-loader_wapomi

IMPHASH c66e52db56884a951b617b63cb7a1469
SHA256 da5c05d33e5d4067031aa0f7fb768dd880333c0cb8167f81ced8dfd78bfae205
MD5 3a3fa2f29403358be9c0268b2c18c153
SHA1 e278d0d5532440f4a081662769e1be28566c2239
SHA512 8491ae97bc96d3669dfd00cf4474e1f2f0d38c03091a14f3a7bfa3eaf0dc69484417a101f21f9be73abc9b7fc9d2612728411e9fd103338c2c3943237b7666e3
SSDEEP 3072:ZgWVRWSq4m1eKD7V89wmnfLSUkYhk9s42TqbVKuh+DEOXpq0q3/5ZVrOjO5OKUOc:zRWSqVmRnfLSokPvVADEO8TBpUm
TLSH
T160546D30E5BE288EFE95D17D963B6FF11D6703D21D1A0AAD229C383D8A7071E39A3115
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

278528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject Sleep SetEvent GetModuleHandleA GetTickCount CreateEventA GetLastError CloseHandle GetCommandLineA CreateProcessA WaitForMultipleObjects GetVersion GetModuleFileNameA LCMapStringW InterlockedIncrement InterlockedDecrement LoadLibraryA GetProcAddress GetStringTypeW GetStringTypeA WriteFile GetFileType GetStdHandle SetHandleCount HeapFree HeapAlloc ResumeThread CreateThread TlsSetValue ExitThread GetStartupInfoA GetExitCodeProcess ExitProcess InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP WideCharToMultiByte MultiByteToWideChar LCMapStringA GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc RtlUnwind GetCurrentThreadId TlsAlloc SetLastError TlsGetValue TerminateProcess GetCurrentProcess UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW

user32

MessageBoxA LoadStringA ReleaseDC GetDC LoadImageA EndPaint DrawTextA BeginPaint DefWindowProcA DestroyWindow DispatchMessageA TranslateMessage GetMessageA PeekMessageA UpdateWindow SetFocus RegisterClassA GetDesktopWindow GetClientRect CreateWindowExA ShowWindow

gdi32

SelectPalette CreateHalftonePalette DeleteDC CreatePalette GetDIBColorTable SelectObject CreateCompatibleDC GetObjectA SetBkMode DeleteObject BitBlt SetBkColor RealizePalette SetTextColor

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_3a3fa2f29403358be9c0268b2c18c153_elex_rhadamanthys_smoke-loader_wapomi

kernel32

user32

gdi32

generic