2026-07-31_ad9a5566ac3bdf8f58ae0db0480a16a2_amadey_dharma_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_ad9a5566ac3bdf8f58ae0db0480a16a2_amadey_dharma_elex_rhadamanthys_smoke-loader_stop
Size 437KB
Sample260731-ndf4wseq7t
SHA256 f6f08ca1965827139978b20fb7d44398aa423bb2f6098f56e8d8e4f0f0a3da02
MD5 ad9a5566ac3bdf8f58ae0db0480a16a2
SHA1 ab1144913ddd65af239f3467ed0b8d2d10bcfbde
SHA512 11f738b39edb5e855832ea1f1b3dcd0e3729f4ac9c5c435d0065db41cf65f6ba98a0f1fb4ca9c107be9db5c099e9af97ea0e192d22c4c6bbf143978361264559
SSDEEP 6144:enWn85hcO20tuQdb+t8KU8/LU7CHeowOKsRf7Pm0t:eS85Gh0gQ6UOLU7C+lsRfr5t
TLSH
T19E944B30AAE0C035F6F712B459B583B8693ABDB26B3490CF62D027DE1A356E49D30757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_ad9a5566ac3bdf8f58ae0db0480a16a2_amadey_dharma_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-07-31_ad9a5566ac3bdf8f58ae0db0480a16a2_amadey_dharma_elex_rhadamanthys_smoke-loader_stop

.exe 437KB

2026-07-31_ad9a5566ac3bdf8f58ae0db0480a16a2_amadey_dharma_elex_rhadamanthys_smoke-loader_stop

IMPHASH 6cbc9f8ad66c9e2c421c1d4c0a9543d5
SHA256 f6f08ca1965827139978b20fb7d44398aa423bb2f6098f56e8d8e4f0f0a3da02
MD5 ad9a5566ac3bdf8f58ae0db0480a16a2
SHA1 ab1144913ddd65af239f3467ed0b8d2d10bcfbde
SHA512 11f738b39edb5e855832ea1f1b3dcd0e3729f4ac9c5c435d0065db41cf65f6ba98a0f1fb4ca9c107be9db5c099e9af97ea0e192d22c4c6bbf143978361264559
SSDEEP 6144:enWn85hcO20tuQdb+t8KU8/LU7CHeowOKsRf7Pm0t:eS85Gh0gQ6UOLU7C+lsRfr5t
TLSH
T19E944B30AAE0C035F6F712B459B583B8693ABDB26B3490CF62D027DE1A356E49D30757
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetNamedPipeHandleStateW GetLargestConsoleWindowSize EnumSystemLocalesA VerifyVersionInfoW FindFirstFileA GetLastError BackupRead GetProcAddress GetTapeStatus CreateTimerQueueTimer VirtualProtectEx BuildCommDCBW GetProcessVersion GetStringTypeExA GetAtomNameA RegisterWaitForSingleObject CreateHardLinkW TransmitCommChar GetTapeParameters DebugSetProcessKillOnExit GetProcessShutdownParameters OpenFileMappingW GetPrivateProfileSectionA VirtualProtect LocalSize DeleteAtom LCMapStringW SetConsoleTitleA lstrlenW GetFileAttributesA GetConsoleWindow LoadLibraryW GetCurrencyFormatW GetDriveTypeA SetCommTimeouts FindNextVolumeMountPointA GetUserDefaultLCID GlobalLock GetCurrentProcess ReadConsoleA lstrcmpA FileTimeToDosDateTime GetPrivateProfileStringA GetCommandLineW InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleFileNameW HeapValidate IsBadReadPtr RaiseException RtlUnwind TerminateProcess IsDebuggerPresent QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetModuleHandleW ExitProcess FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapDestroy HeapCreate HeapFree VirtualFree GetModuleFileNameA WriteFile FlushFileBuffers WideCharToMultiByte GetConsoleCP GetConsoleMode DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW HeapAlloc HeapSize HeapReAlloc VirtualAlloc GetACP GetOEMCP GetCPInfo IsValidCodePage SetFilePointer InitializeCriticalSectionAndSpinCount LoadLibraryA SetStdHandle WriteConsoleA GetConsoleOutputCP MultiByteToWideChar LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA CloseHandle CreateFileA

advapi32

CloseEventLog RegLoadKeyW SetSecurityDescriptorSacl GetLengthSid SetServiceStatus RegDeleteValueW NotifyBootConfigStatus NotifyChangeEventLog RegSetValueExA CopySid OpenServiceW StartServiceCtrlDispatcherA IsValidAcl

Name

.text

Size

123KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

34KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

243KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wey

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.lijiha

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rivad

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cogos

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_ad9a5566ac3bdf8f58ae0db0480a16a2_amadey_dharma_elex_rhadamanthys_smoke-loader_stop

kernel32

advapi32

generic