2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

General

Target
2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee
Size 149KB
Sample260805-nb5pgaac95
SHA256 89cbf6240d4397fc6b34912985b320a1c8cd6a616afd6ec2da46427e95207d01
MD5 3a52ac3fb87915ba035c84673927e587
SHA1 1328fdbe7dc87a1ef089d8bb7258ee47d2aab617
SHA512 188d1f1facfb6a0e7ac20a601a932caf4c027fb9e95a30cc15d5b1a8622345c463ec7069b55579da40fb5cab337675ab949ef3e74f8d40ff74399346faa846cb
SSDEEP 3072:vbuMGq4hOSOVNjsvvxTOHLEwACT0LP1k9EtiLfLMYqS:TGq4sHVdyg1BT0LP1kQiLfLOS
TLSH
T145E3F126B950D836D06326345C7591B7A56FB4A2237812CB778C2FBE1E707C19E3836B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

.exe 149KB

2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH 0a2b722705899394470a1646c30e74dc
SHA256 89cbf6240d4397fc6b34912985b320a1c8cd6a616afd6ec2da46427e95207d01
MD5 3a52ac3fb87915ba035c84673927e587
SHA1 1328fdbe7dc87a1ef089d8bb7258ee47d2aab617
SHA512 188d1f1facfb6a0e7ac20a601a932caf4c027fb9e95a30cc15d5b1a8622345c463ec7069b55579da40fb5cab337675ab949ef3e74f8d40ff74399346faa846cb
SSDEEP 3072:vbuMGq4hOSOVNjsvvxTOHLEwACT0LP1k9EtiLfLMYqS:TGq4sHVdyg1BT0LP1kQiLfLOS
TLSH
T145E3F126B950D836D06326345C7591B7A56FB4A2237812CB778C2FBE1E707C19E3836B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

26317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtect MultiByteToWideChar WriteFile CloseHandle ReadFile GetFileSize CreateFileW DeleteFileW CreateProcessW GetCommandLineW GetModuleFileNameW GetCurrentProcessId SetErrorMode HeapReAlloc RaiseException RtlUnwind EncodePointer DecodePointer GetSystemTimeAsFileTime GetLastError HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep HeapSize ExitProcess HeapCreate GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount LeaveCriticalSection EnterCriticalSection LCMapStringW GetStringTypeW LoadLibraryW

user32

ShowWindow UpdateWindow CheckRadioButton IsDialogMessageA RealGetWindowClassW CreateWindowExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_3a52ac3fb87915ba035c84673927e587_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

kernel32

user32

generic