2026-07-29_62dc3346a79731de94f7bbd45795cd95_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-07-29_62dc3346a79731de94f7bbd45795cd95_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
Size 279KB
Sample260729-ph8kdage23
SHA256 afcc0fe0aaab5c1a5d96d05538cd6dd0b638ddbc775c0f1cef1ee08060669ab8
MD5 62dc3346a79731de94f7bbd45795cd95
SHA1 678cacae6ba9909926feb5e3fcdade4232b67b58
SHA512 37988151e2ae07b9115f58a5e11c6d970ca99485d65d092953c29c3ebb8f75e61c7c56e8a279ce4d054d71c1a0538bfbd60a8f6ee8aafee05e4d8d57f713c73c
SSDEEP 6144:aLNTiQaH4LREznQmFM+DSB3TTrAQyxuuSjAp3:Gip4VcnhSZBjTFqkj
TLSH
T196540252B3D08072E17260341474CAA21E7F74325FB8588B7B842A7E6F717E1EA7674B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_62dc3346a79731de94f7bbd45795cd95_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-07-29_62dc3346a79731de94f7bbd45795cd95_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

.exe 279KB

2026-07-29_62dc3346a79731de94f7bbd45795cd95_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH f47591d0b63a3123eeb3a45bb77919d2
SHA256 afcc0fe0aaab5c1a5d96d05538cd6dd0b638ddbc775c0f1cef1ee08060669ab8
MD5 62dc3346a79731de94f7bbd45795cd95
SHA1 678cacae6ba9909926feb5e3fcdade4232b67b58
SHA512 37988151e2ae07b9115f58a5e11c6d970ca99485d65d092953c29c3ebb8f75e61c7c56e8a279ce4d054d71c1a0538bfbd60a8f6ee8aafee05e4d8d57f713c73c
SSDEEP 6144:aLNTiQaH4LREznQmFM+DSB3TTrAQyxuuSjAp3:Gip4VcnhSZBjTFqkj
TLSH
T196540252B3D08072E17260341474CAA21E7F74325FB8588B7B842A7E6F717E1EA7674B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

23746

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVolumeNameForVolumeMountPointA GetTempFileNameW SetVolumeLabelA SetDefaultCommConfigA FindResourceA WriteConsoleInputW WriteConsoleOutputCharacterW lstrlenA GetModuleHandleExA GetLocaleInfoA SetLocalTime CommConfigDialogA MapUserPhysicalPages GlobalAddAtomA GetConsoleAliasA ZombifyActCtx SetHandleInformation SetConsoleScreenBufferSize WriteConsoleInputA OpenSemaphoreA GetSystemDefaultLCID _lclose GetModuleHandleW CreateNamedPipeW FindNextVolumeMountPointA GetConsoleAliasesA GetWindowsDirectoryA GetConsoleAliasExesW WaitNamedPipeW SetCommState GetCommandLineA SetCommTimeouts GetDriveTypeA GetEnvironmentStrings LoadLibraryW CopyFileW _hread GetExitCodeProcess EnumSystemCodePagesA GetConsoleAliasW GetFileAttributesW ReadFile GetCompressedFileSizeA CompareStringW lstrlenW GetStartupInfoW ReplaceFileA GetShortPathNameA GetStartupInfoA GetLastError GetCurrentDirectoryW SetLastError AttachConsole VerLanguageNameA CreateNamedPipeA RemoveDirectoryA CopyFileA SetComputerNameA UnhandledExceptionFilter LocalAlloc SetConsoleCtrlHandler AddAtomW CreateEventW FoldStringW FindNextFileA SetConsoleTitleW GetModuleHandleA GetProcessShutdownParameters GetCommTimeouts lstrcatW FindNextFileW VirtualProtect GetFileTime GetConsoleCursorInfo QueryPerformanceFrequency TerminateJobObject FindAtomW MoveFileWithProgressW ResetWriteWatch ReadConsoleOutputCharacterW EnumSystemLocalesW DeleteFileA lstrcpyA HeapSize WideCharToMultiByte HeapAlloc HeapReAlloc GetCommandLineW HeapSetInformation IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue DecodePointer TlsFree GetCurrentThreadId GetProcAddress SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection ExitProcess WriteFile GetModuleFileNameW HeapCreate HeapFree CloseHandle FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar GetStringTypeW Sleep SetFilePointer GetConsoleCP GetConsoleMode RaiseException RtlUnwind SetStdHandle FlushFileBuffers WriteConsoleW CreateFileW

user32

CharUpperW

winhttp

WinHttpWriteData

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_62dc3346a79731de94f7bbd45795cd95_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

winhttp

generic