2026-08-03_50c6a8b436684c6ca1bcafc4b4b8e0f0_amadey_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_50c6a8b436684c6ca1bcafc4b4b8e0f0_amadey_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 13.8MB
Sample260803-c66dpsbj5x
SHA256 cf81474d1a2a144f5ac026d4ffbdcf1d04b1d7d2c51c670255391bfb4a041081
MD5 50c6a8b436684c6ca1bcafc4b4b8e0f0
SHA1 7114e7c121a30e7129e1cd68744ce738292b7bae
SHA512 6c1d19a83f4e9b07731e54503d2c645fff3725d296447e73207dd344ee3420c006fd20d7eca2c1d679d43b3d230b13040e041273f59e4fda77f858d0681488c4
SSDEEP 6144:IgaoUsajulQpfqtA1C1twSqer5+n/9Sqer5+nDFZxxxxxxxxxxxxxxxxxxxxxxxP:I6taj3k61Ccer5+n1er5+nZ
TLSH
T1E9E6500541F90D57DE66BA34757F0B1FCCE9181A706EB30921A0F16EFAB5953C82A3B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_50c6a8b436684c6ca1bcafc4b4b8e0f0_amadey_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-03_50c6a8b436684c6ca1bcafc4b4b8e0f0_amadey_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 13.8MB

2026-08-03_50c6a8b436684c6ca1bcafc4b4b8e0f0_amadey_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 9ae33731e854d7500b6b6eac229715f1
SHA256 cf81474d1a2a144f5ac026d4ffbdcf1d04b1d7d2c51c670255391bfb4a041081
MD5 50c6a8b436684c6ca1bcafc4b4b8e0f0
SHA1 7114e7c121a30e7129e1cd68744ce738292b7bae
SHA512 6c1d19a83f4e9b07731e54503d2c645fff3725d296447e73207dd344ee3420c006fd20d7eca2c1d679d43b3d230b13040e041273f59e4fda77f858d0681488c4
SSDEEP 6144:IgaoUsajulQpfqtA1C1twSqer5+n/9Sqer5+nDFZxxxxxxxxxxxxxxxxxxxxxxxP:I6taj3k61Ccer5+n1er5+nZ
TLSH
T1E9E6500541F90D57DE66BA34757F0B1FCCE9181A706EB30921A0F16EFAB5953C82A3B2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28220

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetDriveTypeW EnumCalendarInfoW MoveFileExW InterlockedDecrement CreateJobObjectW SetHandleInformation GetProfileStringW SetVolumeMountPointW GetComputerNameW FreeEnvironmentStringsA GetModuleHandleW GenerateConsoleCtrlEvent GetConsoleAliasesLengthA GetConsoleAliasExesW EnumTimeFormatsA EnumTimeFormatsW TzSpecificLocalTimeToSystemTime GetEnvironmentStrings GetConsoleCP GlobalAlloc LoadLibraryW TerminateThread FatalAppExitW GetCalendarInfoW GetStartupInfoW RaiseException GetPrivateProfileIntW InterlockedExchange GetStartupInfoA SetThreadLocale GetLastError GetCurrentDirectoryW GetNumaProcessorNode PeekConsoleInputW MoveFileW EnumSystemCodePagesW OpenMutexA GetProcessId LocalAlloc BuildCommDCBAndTimeoutsW GetNumberFormatW RemoveDirectoryW GlobalGetAtomNameW FindNextFileA EnumDateFormatsA GlobalUnWire GetModuleHandleA SetLocaleInfoW EnumResourceNamesA CreateMailslotA VirtualProtect EnumDateFormatsW GetShortPathNameW OpenSemaphoreW FindFirstVolumeA FindAtomW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DeleteFileW AddConsoleAliasA CreateFileW ReadFile FlushFileBuffers FindFirstFileW SetDefaultCommConfigA GetCommandLineW GetFileSize BackupRead WriteConsoleW SetStdHandle InterlockedIncrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer HeapFree HeapAlloc GetProcAddress ExitProcess DeleteFileA HeapSetInformation RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate WriteFile GetStdHandle GetModuleFileNameW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage GetStringTypeW MultiByteToWideChar SetFilePointer WideCharToMultiByte GetConsoleMode HeapReAlloc LCMapStringW CloseHandle

user32

CharUpperW LoadMenuA

gdi32

SelectPalette GetTextFaceW

advapi32

LookupAccountSidW

shell32

DragFinish

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_50c6a8b436684c6ca1bcafc4b4b8e0f0_amadey_elex_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

gdi32

advapi32

shell32

generic