2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop
Size 1.3MB
Sample260804-qpyt7a1gnb
SHA256 d90a3d895385a4983ad5f538ef0499f9f62c38a7a44d2b1056d8fc9b1c93a69d
MD5 f86c8a3885ae3516823672e13e98afe7
SHA1 10fb6805ac12223bd99095c902ed0a0e84b22da6
SHA512 be8c4d36d3c1f6b546dd3ee6d53a94637204a9b2a9d482c4553ba2045558f25497f747d330e1d1eb9231fb5a5a7e877231750d6599291e56474ab7a8351b7a55
SSDEEP 24576:mwfLrvi4cRIyDe3SUNaXy+WypoGHUnQ/tbw/2Mkjy6Fr7g0oH:F+i3DsX1WHJQ/lFTjN4
TLSH
T1E455121030D5CC77F4EB21B3843186746ABA2E817F0A295B7FC4766EE2771B6DAB1244
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 1.3MB

2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 1ff011c2e13ea492fe69b2fbfc802083
SHA256 d90a3d895385a4983ad5f538ef0499f9f62c38a7a44d2b1056d8fc9b1c93a69d
MD5 f86c8a3885ae3516823672e13e98afe7
SHA1 10fb6805ac12223bd99095c902ed0a0e84b22da6
SHA512 be8c4d36d3c1f6b546dd3ee6d53a94637204a9b2a9d482c4553ba2045558f25497f747d330e1d1eb9231fb5a5a7e877231750d6599291e56474ab7a8351b7a55
SSDEEP 24576:mwfLrvi4cRIyDe3SUNaXy+WypoGHUnQ/tbw/2Mkjy6Fr7g0oH:F+i3DsX1WHJQ/lFTjN4
TLSH
T1E455121030D5CC77F4EB21B3843186746ABA2E817F0A295B7FC4766EE2771B6DAB1244
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27713

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\cbs\build\ec922632-90cb-1015-8202-b7f05167b5ef\in\CTSDK\AL_Installer\Release\oalinst.pdb

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

kernel32

GetFileAttributesA GetProcAddress LoadLibraryA FreeResource SizeofResource LoadResource FindResourceA ReadFile SetEndOfFile GetLocaleInfoW HeapSize IsValidCodePage IsValidLocale DeleteFileA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetStringTypeW GetStringTypeA CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetFilePointer FlushFileBuffers SetStdHandle InterlockedExchange RemoveDirectoryA CreateDirectoryA GetModuleFileNameA GetSystemDirectoryA CopyFileA GetTempFileNameA LockResource MoveFileExA GetTimeZoneInformation CompareStringA CompareStringW EnumSystemLocalesA VirtualAlloc GetLastError HeapFree HeapAlloc MoveFileA GetCommandLineA GetVersionExA GetProcessHeap GetStartupInfoA HeapDestroy HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection FatalAppExitA EnterCriticalSection SetEnvironmentVariableA HeapReAlloc GetModuleHandleA ExitProcess WriteFile GetStdHandle CloseHandle TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent WideCharToMultiByte GetConsoleCP GetConsoleMode RtlUnwind GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId GetCurrentThread LCMapStringA MultiByteToWideChar LCMapStringW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSection Sleep SetConsoleCtrlHandler FreeLibrary

user32

LoadCursorA RegisterClassExA ShowWindow UpdateWindow GetMessageA TranslateMessage DispatchMessageA MessageBoxA PostQuitMessage LoadIconA SetClassLongA LoadImageA CreateWindowExA SendMessageA BeginPaint GetClientRect MoveWindow DrawTextA EndPaint DefWindowProcA

gdi32

CreateCompatibleDC SelectObject BitBlt DeleteDC GetStockObject

advapi32

RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteKeyA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_f86c8a3885ae3516823672e13e98afe7_amadey_elex_rhadamanthys_smoke-loader_stop

version

kernel32

user32

gdi32

advapi32

generic