2026-08-10_ef561d8693aa8ddc8e99d7f7491dc12f_amadey_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_ef561d8693aa8ddc8e99d7f7491dc12f_amadey_elex_rhadamanthys_smoke-loader_stop
Size 351KB
Sample260810-3cwkhsbb69
SHA256 3d17eeff158efe79be0475942c81d912e6541141138306646920abb513f74acc
MD5 ef561d8693aa8ddc8e99d7f7491dc12f
SHA1 afbeb33c124dacffbf46f0767d63c648abb71806
SHA512 b33d38c242cdd021040192a3914185e6e4611ec6869803b96cea9548fe835e36488ee959d239c251dc203a6263de7c493c071120b1e585a1def6a3d30834e0cd
SSDEEP 1536:FfxRGsxEUue/kaP3o0HMeeekiKEwarnl9L+fkI4wmxkt8CC1g15ZWANsnFdxsnFh:5xRtEUueMwzjrS4wmyt1iw5ZWAsndsnX
TLSH
T16C748324A6A14D7EDF175AFDD04E98EF5A4FDDE302C901262BF197D6CA202E4840ED1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-10_ef561d8693aa8ddc8e99d7f7491dc12f_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 351KB

2026-08-10_ef561d8693aa8ddc8e99d7f7491dc12f_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 1f3b494f99fba2339842e1dd329eb17d
SHA256 3d17eeff158efe79be0475942c81d912e6541141138306646920abb513f74acc
MD5 ef561d8693aa8ddc8e99d7f7491dc12f
SHA1 afbeb33c124dacffbf46f0767d63c648abb71806
SHA512 b33d38c242cdd021040192a3914185e6e4611ec6869803b96cea9548fe835e36488ee959d239c251dc203a6263de7c493c071120b1e585a1def6a3d30834e0cd
SSDEEP 1536:FfxRGsxEUue/kaP3o0HMeeekiKEwarnl9L+fkI4wmxkt8CC1g15ZWANsnFdxsnFh:5xRtEUueMwzjrS4wmyt1iw5ZWAsndsnX
TLSH
T16C748324A6A14D7EDF175AFDD04E98EF5A4FDDE302C901262BF197D6CA202E4840ED1E
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

9f:44:fe:fb:70:ce:85:64:b5:e8:dc:40:d4:2c:26:63:37:07:e1:d9:c9:13:d6:cf:c6:c6:14:88:5a:33:22:57

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=SC331902,CN=SimpleHelp Ltd,O=SimpleHelp Ltd,ST=Midlothian,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130853636f746c616e64,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Jul 15, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Digest

b8:57:dd:50:ab:86:84:7e:2c:21:1e:b1:b2:53:10:33:33:7b:b3:93

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jul 15, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:b9:3d:d9:e7:e9:26:32:ac:d6:0a:be:ac:38

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

4b:2c:3b:01:01:8b:ad:2a:bc:8c:7b:5b:3e:ed:90:57

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 22, 2021 - Mar 21, 2046

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Globalsign R45 TSA for Authenticode 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:b8:30:0d:fb:a8:75:b3:3b:57:cc:26:37:82

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

Serial Number

88:df:10:3c:59:00:2f:69:0f:44:29:d9:10:54:87:8b

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 15, 2024 - Mar 15, 2027

Minor OS version

Major OS version

Entry point

26572

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

timeGetTime

kernel32

InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection CloseHandle GetLastError GetCurrentDirectoryA GetCurrentProcess FormatMessageA SetCurrentDirectoryA LoadLibraryA LocalAlloc GetModuleHandleA GetVersionExA LocalFree CreateThread WaitForSingleObject ExitProcess SetEnvironmentVariableA GetProcAddress lstrlenA HeapFree HeapAlloc FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileA FindNextFileA FindClose WideCharToMultiByte MultiByteToWideChar GetFileAttributesA GetDriveTypeA GetFullPathNameA GetCommandLineA GetProcessHeap TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapDestroy HeapCreate VirtualFree SetEndOfFile VirtualAlloc HeapReAlloc WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement Sleep RtlUnwind SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode FlushFileBuffers GetCPInfo GetACP GetOEMCP SetFilePointer FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetTimeZoneInformation LCMapStringA LCMapStringW CompareStringA CompareStringW CreateFileA SetStdHandle HeapSize GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW ReadFile GetStringTypeA GetStringTypeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_ef561d8693aa8ddc8e99d7f7491dc12f_amadey_elex_rhadamanthys_smoke-loader_stop

winmm

kernel32

generic