shodi | 2026-08-01_f65ee85439d4b2736a6fc35b2eb307de_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee_vidar

General

Target
2026-08-01_f65ee85439d4b2736a6fc35b2eb307de_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 535KB
Sample260801-pk4zzaae99
SHA256 28a1bf3fc9675785bb8c773d1f8d17a83074425ca38d1dc9ed4709b5cf7d3209
MD5 f65ee85439d4b2736a6fc35b2eb307de
SHA1 5beb7901943f6de80da84732359cffca171a27d0
SHA512 e121935bad20f32ad335148457213efe19dbb8c416c5385d2aba18c6b0171b54ec7e6c0cc43bd48ea292afa24b82dc2072343f8b45ebd442def64d6dd90b5d58
SSDEEP 6144:NSdflGXd4OvDzewKLG/jhOrpBGAO/cAYmQIyHaeWRko7/7A0KAyEIgrN3h08zHgt:iflGXd4OvXkLG/UrHGQpHTpUNIg5h08m
TLSH
T18CC4BE2AB6D140B4D06BC170C75A9673EA72787A07206AEF47E0DA711F37AE0A73C355
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm shodi

Detects Shodi worm 1 IoCs

resource	yara_rule
sample	family_shodi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_f65ee85439d4b2736a6fc35b2eb307de_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee_vidar

2026-08-01_f65ee85439d4b2736a6fc35b2eb307de_elex_nymaim_rhadamanthys_smoke-loader_stealc_tofsee_vidar

.exe 535KB

IMPHASH 77f13bc24efea5a05601b43cf44d1f1a
SHA256 28a1bf3fc9675785bb8c773d1f8d17a83074425ca38d1dc9ed4709b5cf7d3209
MD5 f65ee85439d4b2736a6fc35b2eb307de
SHA1 5beb7901943f6de80da84732359cffca171a27d0
SHA512 e121935bad20f32ad335148457213efe19dbb8c416c5385d2aba18c6b0171b54ec7e6c0cc43bd48ea292afa24b82dc2072343f8b45ebd442def64d6dd90b5d58
SSDEEP 6144:NSdflGXd4OvDzewKLG/jhOrpBGAO/cAYmQIyHaeWRko7/7A0KAyEIgrN3h08zHgt:iflGXd4OvXkLG/UrHGQpHTpUNIg5h08m
TLSH
T18CC4BE2AB6D140B4D06BC170C75A9673EA72787A07206AEF47E0DA711F37AE0A73C355
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

15703

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths