2026-07-30_b8f7c46979e0d41e8c808a47b6dfe41c_amadey_elex_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_b8f7c46979e0d41e8c808a47b6dfe41c_amadey_elex_rhadamanthys_smoke-loader
Size 2.0MB
Sample260730-144zvsgd76
SHA256 872a4bfb92c4ce2e691af3a9afab9aaffe7b00de1b91c50ac6b88af5d0ea304b
MD5 b8f7c46979e0d41e8c808a47b6dfe41c
SHA1 f0f29fa5817f8db38eee72b9319248e373458c40
SHA512 edf5134d4f0f0c2e15a54df9a504da3ee416ce4954bc2adb3e3df74cb6f0031413be4ba7c5e2ce6e87f5c5e1847f1da02e2d858d539033b8ee58a6a79db0275a
SSDEEP 49152:r+CQS88KQUnnhs3Yl5ar38YthiqCZn0O4ZY1+NXRs36y+z:6S8jQIq3Yle38YthiqCZ0O40yBS6y
TLSH
T1A4A589E6927189E1D41720F2961786BF2D372F3716117B83A2B9AEED39213C17376342
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_b8f7c46979e0d41e8c808a47b6dfe41c_amadey_elex_rhadamanthys_smoke-loader

File Explorer

2026-07-30_b8f7c46979e0d41e8c808a47b6dfe41c_amadey_elex_rhadamanthys_smoke-loader

.exe 2.0MB

2026-07-30_b8f7c46979e0d41e8c808a47b6dfe41c_amadey_elex_rhadamanthys_smoke-loader

IMPHASH f016d9c09070f637d34f03c3d3b071e5
SHA256 872a4bfb92c4ce2e691af3a9afab9aaffe7b00de1b91c50ac6b88af5d0ea304b
MD5 b8f7c46979e0d41e8c808a47b6dfe41c
SHA1 f0f29fa5817f8db38eee72b9319248e373458c40
SHA512 edf5134d4f0f0c2e15a54df9a504da3ee416ce4954bc2adb3e3df74cb6f0031413be4ba7c5e2ce6e87f5c5e1847f1da02e2d858d539033b8ee58a6a79db0275a
SSDEEP 49152:r+CQS88KQUnnhs3Yl5ar38YthiqCZn0O4ZY1+NXRs36y+z:6S8jQIq3Yle38YthiqCZ0O40yBS6y
TLSH
T1A4A589E6927189E1D41720F2961786BF2D372F3716117B83A2B9AEED39213C17376342
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

527076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSection GetModuleHandleW lstrlenW WideCharToMultiByte MoveFileExW GetTempFileNameW GetTempPathW DeleteFileW MoveFileW WriteFile ReadFile GetFileSize CreateFileW Process32NextW Process32FirstW CreateToolhelp32Snapshot TerminateProcess OpenProcess SleepEx SetFileAttributesW GetModuleFileNameW GetComputerNameA Sleep GetCurrentProcessId GetSystemTime GetCommandLineW HeapSetInformation GetStartupInfoW RaiseException RtlUnwind HeapAlloc HeapFree ExitThread GetCurrentThreadId CreateThread SetUnhandledExceptionFilter ExitProcess DecodePointer GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW MultiByteToWideChar HeapReAlloc HeapSize SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers FreeLibrary InterlockedExchange GetStringTypeW SetStdHandle WriteConsoleW SetEndOfFile GetProcessHeap WaitForSingleObject CloseHandle GetLastError DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetCurrentProcess GetModuleHandleA CreateProcessW LoadLibraryW SystemTimeToFileTime GetLocalTime FindResourceExW FindResourceW LoadResource LockResource SizeofResource LoadLibraryA GetFileType LocalAlloc WaitForMultipleObjects VirtualQueryEx ReadProcessMemory ProcessIdToSessionId Module32FirstW Module32NextW GetProcAddress

advapi32

CreateProcessAsUserW LookupPrivilegeValueW AdjustTokenPrivileges RegQueryValueExW CreateServiceW RegSetValueExW RegCreateKeyExW OpenSCManagerW OpenServiceW QueryServiceConfigW ChangeServiceConfigW StartServiceW CloseServiceHandle RegCloseKey RegOpenKeyExW CryptAcquireContextW CryptReleaseContext GetUserNameW GetUserNameA AllocateAndInitializeSid CheckTokenMembership FreeSid OpenProcessToken

shell32

ShellExecuteW SHGetSpecialFolderPathW

psapi

GetModuleFileNameExW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_b8f7c46979e0d41e8c808a47b6dfe41c_amadey_elex_rhadamanthys_smoke-loader

kernel32

advapi32

shell32

psapi

userenv

generic