2026-08-05_8fd4eb0dc70aee63f73ef49fbfbe55bf_elex_maze_rhadamanthys_smoke-loader_stop

General

Target
2026-08-05_8fd4eb0dc70aee63f73ef49fbfbe55bf_elex_maze_rhadamanthys_smoke-loader_stop
Size 12.0MB
Sample260805-wlpd8sysbx
SHA256 7e69e15d19bc3f7dd469aacceb0d9cd548c70eee41fe3d6a8991be7f10a1218d
MD5 8fd4eb0dc70aee63f73ef49fbfbe55bf
SHA1 4a6d65c6119655986b1a23cc5b4d856afc298a72
SHA512 1a6ea95b49cc6ee932608fbdf6cbf6c7d8157f8f2d1d432a76738dab58c35ea7c3d6178088734ffa968a4cd12576f5fde84172d07b9b7125a7b70977cbb10668
SSDEEP 98304:SMffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff:
TLSH
T114C6325383E13D49EA7A8BB2DF2F86EC760EF6508E59377931199E9B00B1076C563B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_8fd4eb0dc70aee63f73ef49fbfbe55bf_elex_maze_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-05_8fd4eb0dc70aee63f73ef49fbfbe55bf_elex_maze_rhadamanthys_smoke-loader_stop

.exe 12.0MB

2026-08-05_8fd4eb0dc70aee63f73ef49fbfbe55bf_elex_maze_rhadamanthys_smoke-loader_stop

IMPHASH 8e46a2841daf40f5670f682d013443e4
SHA256 7e69e15d19bc3f7dd469aacceb0d9cd548c70eee41fe3d6a8991be7f10a1218d
MD5 8fd4eb0dc70aee63f73ef49fbfbe55bf
SHA1 4a6d65c6119655986b1a23cc5b4d856afc298a72
SHA512 1a6ea95b49cc6ee932608fbdf6cbf6c7d8157f8f2d1d432a76738dab58c35ea7c3d6178088734ffa968a4cd12576f5fde84172d07b9b7125a7b70977cbb10668
SSDEEP 98304:SMffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff:
TLSH
T114C6325383E13D49EA7A8BB2DF2F86EC760EF6508E59377931199E9B00B1076C563B10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

26745

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\matu\41\xi.pdb

kernel32

DebugActiveProcess GetThreadContext WriteConsoleInputW GetLocaleInfoA GetConsoleAliasA GetCurrentProcess InterlockedCompareExchange GetNumberFormatA ReadConsoleW GetWindowsDirectoryA GetCompressedFileSizeW GetUserDefaultLangID GlobalAlloc GetVolumeInformationA GlobalFindAtomA LoadLibraryW TerminateThread GetConsoleAliasExesLengthW GetFileAttributesW GetModuleFileNameW GetACP GetLastError GetThreadLocale RemoveDirectoryA CopyFileA VirtualAllocEx GetNumaHighestNodeNumber LoadLibraryA WriteConsoleA SetCalendarInfoW CreateHardLinkW FindFirstVolumeMountPointW AddAtomW VirtualLock VirtualProtect ReadConsoleInputW DeleteTimerQueueTimer FindNextVolumeA WriteProcessMemory CreateFileW WriteConsoleW WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapFree GetCommandLineA GetCPInfo RaiseException RtlUnwind HeapAlloc IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetOEMCP GetCurrentThreadId IsDebuggerPresent GetStdHandle GetFileType GetProcessHeap ReadFile ExitProcess GetModuleHandleExW HeapSize CloseHandle GetModuleFileNameA WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx LoadLibraryExW SetStdHandle FlushFileBuffers OutputDebugStringW

winhttp

WinHttpWriteData

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_8fd4eb0dc70aee63f73ef49fbfbe55bf_elex_maze_rhadamanthys_smoke-loader_stop

kernel32

winhttp

generic