2026-08-02_053631fa77e774c2348c5a15e97ad746_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee_wapomi

General

Target
2026-08-02_053631fa77e774c2348c5a15e97ad746_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee_wapomi
Size 187KB
Sample260802-sbfskabf75
SHA256 2f5107208e4d5e2b69da950cbcbddd23c0fe21d51ffc03d73f7c21487f101048
MD5 053631fa77e774c2348c5a15e97ad746
SHA1 a361e1430cf60a24e71b70f4bd2e69b7ba1911d8
SHA512 d87b24c3bf200c022b28ca720f4fc32761030bbded10fe8a02be8bb5b15590e7fccad24d2474bfb6726757c2b738c100c2bd6aa40ff13d4561ada0c63a514c38
SSDEEP 3072:tLKCpw8DA3Yr3mUOJfXEEZnRCI3AXny/Hj8LG4MVj/FIgW6d4n3meIOuGCH:z83YLmUOFXEEZnRCI3AXny/Hj8LG4ujy
TLSH
T110148D3536D0C072D493253445A5C7B14EBE7C723362A89FBBED0AB99F246D0A63839D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_053631fa77e774c2348c5a15e97ad746_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee_wapomi

File Explorer

2026-08-02_053631fa77e774c2348c5a15e97ad746_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee_wapomi

.exe 187KB

2026-08-02_053631fa77e774c2348c5a15e97ad746_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee_wapomi

IMPHASH ba6e7d1028cd73d291b266f23866459e
SHA256 2f5107208e4d5e2b69da950cbcbddd23c0fe21d51ffc03d73f7c21487f101048
MD5 053631fa77e774c2348c5a15e97ad746
SHA1 a361e1430cf60a24e71b70f4bd2e69b7ba1911d8
SHA512 d87b24c3bf200c022b28ca720f4fc32761030bbded10fe8a02be8bb5b15590e7fccad24d2474bfb6726757c2b738c100c2bd6aa40ff13d4561ada0c63a514c38
SSDEEP 3072:tLKCpw8DA3Yr3mUOJfXEEZnRCI3AXny/Hj8LG4MVj/FIgW6d4n3meIOuGCH:z83YLmUOFXEEZnRCI3AXny/Hj8LG4ujy
TLSH
T110148D3536D0C072D493253445A5C7B14EBE7C723362A89FBBED0AB99F246D0A63839D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

196608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\b\HTE\QDART\QDART_MFG\BSP_Storage\QSaharaServer\Release\QSaharaServer.pdb

kernel32

CloseHandle SetCommTimeouts CreateFileA WriteFile ReadFile Sleep GetTickCount GetSystemInfo GetSystemTimeAsFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetLastError GetFileType FindClose GetDriveTypeA FindFirstFileExA GetFileAttributesA EnterCriticalSection LeaveCriticalSection GetProcAddress GetModuleHandleW ExitProcess DecodePointer SetFilePointer GetCommandLineA HeapSetInformation TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer IsProcessorFeaturePresent WideCharToMultiByte GetTimeZoneInformation SetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetStartupInfoW DeleteCriticalSection GetFullPathNameA HeapFree GetCurrentDirectoryW SetCurrentDirectoryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread GetConsoleCP GetConsoleMode SetEndOfFile HeapAlloc GetProcessHeap MultiByteToWideChar InterlockedExchange FatalAppExitA SetConsoleCtrlHandler FreeLibrary LoadLibraryW GetLocaleInfoW GetModuleFileNameW HeapSize HeapQueryInformation HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetCurrentProcessId RtlUnwind GetDriveTypeW LCMapStringW WriteConsoleW FlushFileBuffers GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CreateFileW CompareStringW SetEnvironmentVariableA CreateDirectoryA

Name

.text

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

696B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Ѳ�u�

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_053631fa77e774c2348c5a15e97ad746_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee_wapomi

kernel32

generic