2026-08-09_5ed904c580bf647ab8e12e0faa9f834a_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-08-09_5ed904c580bf647ab8e12e0faa9f834a_elex_rhadamanthys_smoke-loader_stop
Size 1.4MB
Sample260809-w7garatdnb
SHA256 40a7fd26ca41901263c2e09f1ea9fefd2afb88b4f0dc1749395c3b0f55f02acc
MD5 5ed904c580bf647ab8e12e0faa9f834a
SHA1 6c1a7290c44d15583edab70dee7476b5348623f2
SHA512 1dd52bcd4a8f2823b5347a65658104c220a9fadaaae07e165a8bc32867e7cb8f1ccb744e8add96e40e2b156466feca5da4337ca5b48c1922cc1953e2fd5f8767
SSDEEP 12288:Ak598eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:AkkenQ/tbw/2Mkjy6Fr7g0oy
TLSH
T19465022079E0C072DAB203B109E2C76256BEBD615F5513CF77983EADAF382D06676352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_5ed904c580bf647ab8e12e0faa9f834a_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-08-09_5ed904c580bf647ab8e12e0faa9f834a_elex_rhadamanthys_smoke-loader_stop

.exe 1.4MB

2026-08-09_5ed904c580bf647ab8e12e0faa9f834a_elex_rhadamanthys_smoke-loader_stop

IMPHASH 7bf7befe1a38461122bef34137b35ebb
SHA256 40a7fd26ca41901263c2e09f1ea9fefd2afb88b4f0dc1749395c3b0f55f02acc
MD5 5ed904c580bf647ab8e12e0faa9f834a
SHA1 6c1a7290c44d15583edab70dee7476b5348623f2
SHA512 1dd52bcd4a8f2823b5347a65658104c220a9fadaaae07e165a8bc32867e7cb8f1ccb744e8add96e40e2b156466feca5da4337ca5b48c1922cc1953e2fd5f8767
SSDEEP 12288:Ak598eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:AkkenQ/tbw/2Mkjy6Fr7g0oy
TLSH
T19465022079E0C072DAB203B109E2C76256BEBD615F5513CF77983EADAF382D06676352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

35049

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\SSD_WinPro_Code\Pre_Code\IRSTPatch\Release\IRSTPatch.pdb

kernel32

DeleteCriticalSection GetLastError GetLocalTime LeaveCriticalSection GetProcAddress EnterCriticalSection InitializeCriticalSection GetModuleHandleW InterlockedIncrement InterlockedDecrement WideCharToMultiByte MultiByteToWideChar GetStringTypeW InitializeCriticalSectionEx Sleep EncodePointer DecodePointer GetLocaleInfoEx HeapFree GetCPInfo GetCommandLineW InitializeCriticalSectionAndSpinCount HeapAlloc RaiseException RtlUnwind IsProcessorFeaturePresent IsDebuggerPresent GetProcessHeap SetLastError GetCurrentThreadId GetStdHandle GetFileType InitOnceExecuteOnce GetStartupInfoW ExitProcess GetModuleHandleExW WriteFile GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx FlushFileBuffers CloseHandle HeapSize IsValidCodePage GetACP GetOEMCP GetModuleFileNameW QueryPerformanceCounter GetSystemTimeAsFileTime GetTickCount64 GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter FlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentProcess TerminateProcess GetUserDefaultLocaleName LCMapStringEx IsValidLocaleName EnumSystemLocalesEx HeapReAlloc SetFilePointer ReadConsoleW LoadLibraryExW SetStdHandle WriteConsoleW OutputDebugStringW LoadLibraryW CreateFileW SetEndOfFile

advapi32

RegCreateKeyExW RegSetValueExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_5ed904c580bf647ab8e12e0faa9f834a_elex_rhadamanthys_smoke-loader_stop

kernel32

advapi32

generic