2026-08-09_b534948fe9759c32265ab8ee3956f31f_amadey_elex_karagany_rhadamanthys_smoke-loader_stop

General

Target
2026-08-09_b534948fe9759c32265ab8ee3956f31f_amadey_elex_karagany_rhadamanthys_smoke-loader_stop
Size 1.2MB
Sample260809-tllbgatzfx
SHA256 b714c21018ec3d74ee11515de7a390c257a51b3e4d2035503e04fbed9cf5b752
MD5 b534948fe9759c32265ab8ee3956f31f
SHA1 372c6b3ddbe10ffb35da51f20e614d73b31566f7
SHA512 47ee2032d632148043aaa7b6033176f6a409552bd3324a0045e9ccbe899875456e8969728ae78284c3a505f6b1159b4bb0c75eff74ff9cfa3fc472520b3c99dd
SSDEEP 12288:eL3iKep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:1R+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T130552322B64180B6D5E566305874C2B621BBBEB05FB601C37BE41276EF7A4D24D3A393
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_b534948fe9759c32265ab8ee3956f31f_amadey_elex_karagany_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-09_b534948fe9759c32265ab8ee3956f31f_amadey_elex_karagany_rhadamanthys_smoke-loader_stop

.exe 1.2MB

2026-08-09_b534948fe9759c32265ab8ee3956f31f_amadey_elex_karagany_rhadamanthys_smoke-loader_stop

IMPHASH 05e033c5248aac0318c04bd0131ae21f
SHA256 b714c21018ec3d74ee11515de7a390c257a51b3e4d2035503e04fbed9cf5b752
MD5 b534948fe9759c32265ab8ee3956f31f
SHA1 372c6b3ddbe10ffb35da51f20e614d73b31566f7
SHA512 47ee2032d632148043aaa7b6033176f6a409552bd3324a0045e9ccbe899875456e8969728ae78284c3a505f6b1159b4bb0c75eff74ff9cfa3fc472520b3c99dd
SSDEEP 12288:eL3iKep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:1R+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T130552322B64180B6D5E566305874C2B621BBBEB05FB601C37BE41276EF7A4D24D3A393
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11018

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\AliWorkbench\modules\WangWangPostInstall\Release\EndProcess.pdb

kernel32

LockResource LocalFree WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection GetLastError EnterCriticalSection LeaveCriticalSection RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetModuleFileNameW SizeofResource LoadResource FindResourceW FindResourceExW DeleteCriticalSection GetCommandLineW CreateFileW WriteConsoleW SetStdHandle LoadLibraryW HeapSetInformation GetStartupInfoW GetCPInfo GetSystemTimeAsFileTime RtlUnwind LCMapStringW SetUnhandledExceptionFilter GetProcAddress GetModuleHandleW ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers GetACP GetOEMCP IsValidCodePage CloseHandle

user32

wsprintfW

advapi32

GetNamedSecurityInfoW SetNamedSecurityInfoW GetExplicitEntriesFromAclW DeleteAce IsWellKnownSid

shell32

CommandLineToArgvW

shlwapi

PathRemoveFileSpecW StrCmpIW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_b534948fe9759c32265ab8ee3956f31f_amadey_elex_karagany_rhadamanthys_smoke-loader_stop

kernel32

user32

advapi32

shell32

shlwapi

generic