2026-08-01_6b217480cbb43e20c78a5416e056f832_amadey_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-08-01_6b217480cbb43e20c78a5416e056f832_amadey_elex_rhadamanthys_smoke-loader_stop
Size 3.9MB
Sample260801-dpdssscg64
SHA256 4494effa532825020913199b706ea4a762501716dc9abe26985ebe40f1d6d6aa
MD5 6b217480cbb43e20c78a5416e056f832
SHA1 01fe658888f20b0346ebbc0524ec0a32b703cc94
SHA512 f520cb8b9e7ffd710d30d09a2d936cf15f03f848c757c1c881d6ace95b6f38fb4f04ea9c8fcf13b5235fca1cd88635256b2c33f89a88167b2ca99fbb7f18d279
SSDEEP 98304:yHZEUgZD6NiHhGnO1UXD/OT4ZXzfad+RvdRICkgV:yHZI6qMnO12D/OcZDyd+VdSuV
TLSH
T18F1633BD6C1950E2EF764EBC0E6E599438FACC26327EC512E6A008C645E525E373D21F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_6b217480cbb43e20c78a5416e056f832_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-01_6b217480cbb43e20c78a5416e056f832_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 3.9MB

2026-08-01_6b217480cbb43e20c78a5416e056f832_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 088d01527318a0fbd3989ec82be55fac
SHA256 4494effa532825020913199b706ea4a762501716dc9abe26985ebe40f1d6d6aa
MD5 6b217480cbb43e20c78a5416e056f832
SHA1 01fe658888f20b0346ebbc0524ec0a32b703cc94
SHA512 f520cb8b9e7ffd710d30d09a2d936cf15f03f848c757c1c881d6ace95b6f38fb4f04ea9c8fcf13b5235fca1cd88635256b2c33f89a88167b2ca99fbb7f18d279
SSDEEP 98304:yHZEUgZD6NiHhGnO1UXD/OT4ZXzfad+RvdRICkgV:yHZI6qMnO12D/OcZDyd+VdSuV
TLSH
T18F1633BD6C1950E2EF764EBC0E6E599438FACC26327EC512E6A008C645E525E373D21F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7271

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\VC2005_专区\VC新版登录器\TLdengluqiDun\release\TLdengluqi.pdb

kernel32

FreeLibrary GetProcAddress VirtualAlloc LoadLibraryA VirtualFree CloseHandle CreateFileA FindClose LockResource WriteFile SizeofResource FindResourceA lstrlenA LoadResource CreateDirectoryA FindFirstFileA GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError RaiseException GetModuleHandleA ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapDestroy HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc Sleep HeapSize InitializeCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind MultiByteToWideChar GetLocaleInfoA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

MessageBoxA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_6b217480cbb43e20c78a5416e056f832_amadey_elex_rhadamanthys_smoke-loader_stop

kernel32

user32

generic