2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

General

Target
2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee
Size 149KB
Sample260808-vrftlsan7t
SHA256 e987da425590df8174403eab9678acd392229859cce752971b111a1351511ae5
MD5 d3b7ec948e6bc83ff2398f29a8732449
SHA1 686aeb48fd596921faf4f8585f576f2650aea58a
SHA512 5673f20d4d9e0586b64cb2601adc7288f1cf095a7bfcbd8dfc620151ec3bb9743ad05537c9e2103bc65320a8f86a1b3e7c609a721ce9dcc2b43e4edd8f273878
SSDEEP 3072:vbuMGq4hOSOVbjsvlTrp0xQRPwTc5qgGL1NcokweGs3JtQNP:TGq4sHVPoJ0GtwWqgm1Nx0JtQt
TLSH
T194E3E11579819472D0A226704CB1D9F3A12BB96223B946CB739C0BBE5F706C19E3D36F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

File Explorer

2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

.exe 149KB

2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

IMPHASH 0a2b722705899394470a1646c30e74dc
SHA256 e987da425590df8174403eab9678acd392229859cce752971b111a1351511ae5
MD5 d3b7ec948e6bc83ff2398f29a8732449
SHA1 686aeb48fd596921faf4f8585f576f2650aea58a
SHA512 5673f20d4d9e0586b64cb2601adc7288f1cf095a7bfcbd8dfc620151ec3bb9743ad05537c9e2103bc65320a8f86a1b3e7c609a721ce9dcc2b43e4edd8f273878
SSDEEP 3072:vbuMGq4hOSOVbjsvlTrp0xQRPwTc5qgGL1NcokweGs3JtQNP:TGq4sHVPoJ0GtwWqgm1Nx0JtQt
TLSH
T194E3E11579819472D0A226704CB1D9F3A12BB96223B946CB739C0BBE5F706C19E3D36F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

26317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtect MultiByteToWideChar WriteFile CloseHandle ReadFile GetFileSize CreateFileW DeleteFileW CreateProcessW GetCommandLineW GetModuleFileNameW GetCurrentProcessId SetErrorMode HeapReAlloc RaiseException RtlUnwind EncodePointer DecodePointer GetSystemTimeAsFileTime GetLastError HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep HeapSize ExitProcess HeapCreate GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount LeaveCriticalSection EnterCriticalSection LCMapStringW GetStringTypeW LoadLibraryW

user32

ShowWindow UpdateWindow CheckRadioButton IsDialogMessageA RealGetWindowClassW CreateWindowExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_d3b7ec948e6bc83ff2398f29a8732449_amadey_elex_rhadamanthys_smoke-loader_stop_tofsee

kernel32

user32

generic