2026-08-03_6b19ec95b5bd52a0c896f8c5efa95393_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-08-03_6b19ec95b5bd52a0c896f8c5efa95393_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 12.9MB
Sample260803-c2vfmsba94
SHA256 68721c7804491d4e0910bcad046d138bedfcb458a470eb3f4351b55790cf3a38
MD5 6b19ec95b5bd52a0c896f8c5efa95393
SHA1 cee88008b4e934a74b9d5cf64fe7d5efe59051ee
SHA512 e8dd0c182a047c6d1aa2650da27f290b389207d7640fc3ea50bd068973c0e11c5c6b75064d5a26be340d127180f91d50fe7c65ab113d88ef348abc60827d5526
SSDEEP 49152:7p0Q55555555555555555555555555555555555555555555555555555555555V:2
TLSH
T1B0D6C5816EF5A911F3F34A34497557A81A3FBCA7B830815D238036CE6CF66915EA07E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_6b19ec95b5bd52a0c896f8c5efa95393_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-03_6b19ec95b5bd52a0c896f8c5efa95393_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 12.9MB

2026-08-03_6b19ec95b5bd52a0c896f8c5efa95393_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 4597b703dc3d516d86df93cef7f305b0
SHA256 68721c7804491d4e0910bcad046d138bedfcb458a470eb3f4351b55790cf3a38
MD5 6b19ec95b5bd52a0c896f8c5efa95393
SHA1 cee88008b4e934a74b9d5cf64fe7d5efe59051ee
SHA512 e8dd0c182a047c6d1aa2650da27f290b389207d7640fc3ea50bd068973c0e11c5c6b75064d5a26be340d127180f91d50fe7c65ab113d88ef348abc60827d5526
SSDEEP 49152:7p0Q55555555555555555555555555555555555555555555555555555555555V:2
TLSH
T1B0D6C5816EF5A911F3F34A34497557A81A3FBCA7B830815D238036CE6CF66915EA07E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6021

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalUnlock SetVolumeLabelA OpenFile TryEnterCriticalSection CopyFileExW SetEndOfFile FreeLibrary WriteConsoleOutputW CreateJobObjectW GetModuleHandleW CreateNamedPipeW GetConsoleAliasesLengthA GetWindowsDirectoryA GetCompressedFileSizeW GlobalAlloc LoadLibraryW IsProcessInJob InitAtomTable LeaveCriticalSection DnsHostnameToComputerNameW GetTimeFormatW GetAtomNameW GetTimeZoneInformation lstrcatA SetConsoleTitleA VirtualUnlock LCMapStringA GetLastError ChangeTimerQueueTimer HeapSize EnumDateFormatsExA GetConsoleDisplayMode SetFileAttributesA BuildCommDCBW OpenWaitableTimerA LoadLibraryA OpenWaitableTimerW GlobalFindAtomW GetModuleFileNameA FreeEnvironmentStringsW VirtualProtect CompareStringA QueryPerformanceFrequency LocalFree CompareStringW FlushFileBuffers CloseHandle HeapReAlloc HeapAlloc GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection FatalAppExitA EnterCriticalSection HeapCreate HeapDestroy VirtualFree HeapFree VirtualAlloc Sleep GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind SetConsoleCtrlHandler InterlockedExchange SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetLocaleInfoW CreateFileA SetEnvironmentVariableA

user32

GetMonitorInfoW GetDesktopWindow

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_6b19ec95b5bd52a0c896f8c5efa95393_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

generic