2026-08-08_b6f9d9d4e1cc4dad313750b26db9b27a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-08-08_b6f9d9d4e1cc4dad313750b26db9b27a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 13.0MB
Sample260808-vxw3saef29
SHA256 87ac4e080385b2e102d02f1b56db0642932aff0bd042b361e258f14865688b45
MD5 b6f9d9d4e1cc4dad313750b26db9b27a
SHA1 11129bc02e5423220b33071f2cc8f9f334213a13
SHA512 59de5a160dd31fb9bbfec58b76ca621e2d48de0ce7370ac61a38aab200e6fc9c3257853b2d2f73e8363d7eb0098e8e203c8ef6156b8dc2b309ac24025e393453
SSDEEP 98304:vqkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkP:v
TLSH
T14BD60A926FF29049F2FF85719BF299746977FCA2F9A2C3AE0100891F2875641DD4E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_b6f9d9d4e1cc4dad313750b26db9b27a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-08_b6f9d9d4e1cc4dad313750b26db9b27a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 13.0MB

2026-08-08_b6f9d9d4e1cc4dad313750b26db9b27a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 694d640a38a305673498b98114ebcdcd
SHA256 87ac4e080385b2e102d02f1b56db0642932aff0bd042b361e258f14865688b45
MD5 b6f9d9d4e1cc4dad313750b26db9b27a
SHA1 11129bc02e5423220b33071f2cc8f9f334213a13
SHA512 59de5a160dd31fb9bbfec58b76ca621e2d48de0ce7370ac61a38aab200e6fc9c3257853b2d2f73e8363d7eb0098e8e203c8ef6156b8dc2b309ac24025e393453
SSDEEP 98304:vqkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkP:v
TLSH
T14BD60A926FF29049F2FF85719BF299746977FCA2F9A2C3AE0100891F2875641DD4E720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

18852

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

EnumResourceNamesW SetEndOfFile LocalCompact CreateHardLinkA GetProcessHeap EnumResourceTypesA GlobalAlloc LoadLibraryW IsProcessInJob AssignProcessToJobObject CreateEventA IsBadWritePtr GetLastError GetCurrentDirectoryW SetLastError GetProcAddress IsBadHugeWritePtr VerLanguageNameA LoadLibraryA SetConsoleCtrlHandler AddAtomW GlobalHandle GetModuleFileNameA GetOEMCP GlobalUnWire HeapSetInformation GetFileTime GetCurrentThreadId Module32NextW GetDiskFreeSpaceExA ReadConsoleInputW WriteConsoleW CloseHandle FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle SetFilePointer HeapReAlloc WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree GetCommandLineW GetStartupInfoW GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW IsProcessorFeaturePresent GetModuleHandleW ExitProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapCreate ReadFile WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetACP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CreateFileW

user32

ChangeMenuW GetMessageExtraInfo CharUpperBuffA SetCursorPos SetUserObjectSecurity SetCaretPos GetCaretBlinkTime SetClipboardViewer

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_b6f9d9d4e1cc4dad313750b26db9b27a_amadey_elex_gcleaner_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

user32

generic