2026-07-30_64c861304ec483cf1f230c4aac1bb870_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-07-30_64c861304ec483cf1f230c4aac1bb870_amadey_elex_rhadamanthys_smoke-loader_stealc_stop
Size 286KB
Sample260730-2d6ansgl9x
SHA256 af42d5aa212f4d7be3dfe01013e846b0fd16b962a1ab871d178466258651b900
MD5 64c861304ec483cf1f230c4aac1bb870
SHA1 67d0d5f4f3e072082d4e5133835e08c2f8f87939
SHA512 28c0491151aa9de464f3b05cdd36c27134065df751bc6b20becb3c7358cf49535bda4a0aa3afcc2173fb76df6e482beca806500afdb48ad2f42e4123d0019e57
SSDEEP 3072:+mfuSgQPWJfUVf0PJjhezPWKyhy8VJLc4HJsIGJPuewjGFT30CkyP/7:mSgQPWi0PJYzuNxOIGJm+130Ckg/7
TLSH
T1F3549DD1A24380B3ED420D79BDD96EB4DA742CB01BB16FC71BCABA4906732D57B31609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_64c861304ec483cf1f230c4aac1bb870_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-07-30_64c861304ec483cf1f230c4aac1bb870_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 286KB

2026-07-30_64c861304ec483cf1f230c4aac1bb870_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 84e31d32a2cb7830e40cfcbea395c7a1
SHA256 af42d5aa212f4d7be3dfe01013e846b0fd16b962a1ab871d178466258651b900
MD5 64c861304ec483cf1f230c4aac1bb870
SHA1 67d0d5f4f3e072082d4e5133835e08c2f8f87939
SHA512 28c0491151aa9de464f3b05cdd36c27134065df751bc6b20becb3c7358cf49535bda4a0aa3afcc2173fb76df6e482beca806500afdb48ad2f42e4123d0019e57
SSDEEP 3072:+mfuSgQPWJfUVf0PJjhezPWKyhy8VJLc4HJsIGJPuewjGFT30CkyP/7:mSgQPWi0PJYzuNxOIGJm+130Ckg/7
TLSH
T1F3549DD1A24380B3ED420D79BDD96EB4DA742CB01BB16FC71BCABA4906732D57B31609
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

45744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject Sleep CreateThread lstrlenW VirtualProtect GetProcAddress LoadLibraryA VirtualAlloc GetModuleHandleA CreateFileW FreeConsole InterlockedIncrement InterlockedDecrement WideCharToMultiByte InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar GetLastError HeapFree HeapAlloc RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetCPInfo LCMapStringA LCMapStringW HeapCreate VirtualFree HeapReAlloc GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer CloseHandle HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetLocaleInfoW CreateFileA

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_64c861304ec483cf1f230c4aac1bb870_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

generic