2026-08-10_90a09b49fe06cbe8783dd6b8e251f49a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-08-10_90a09b49fe06cbe8783dd6b8e251f49a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 1020KB
Sample260810-e1nb2s1dla
SHA256 f81d5fb22ddf885ef598d9d1bb9eff0c3667843352ba549cc06902a1cfcf1f74
MD5 90a09b49fe06cbe8783dd6b8e251f49a
SHA1 c03c5ebba5700d25215764946b456698476229ac
SHA512 23d1d7257b33a84ef0dc0d68c8357be36ccd05a23db600d71cfb3000b42de235cefaf24b5ba22b38d155e1ba79cbf4d36d6d14cd6a928d70a0615198811f3a38
SSDEEP 24576:1gjMAgjMkVigjULk70Trc7m20zWmQFHDPo/x9g7ZLp:ujM5jMCLjULkQTAKLzJ4HDA/Ql9
TLSH
T1B825AE13B643941AE8154070DD3A8B6C1F393FB65173A54777D4BBAEA532383B0623AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_90a09b49fe06cbe8783dd6b8e251f49a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-10_90a09b49fe06cbe8783dd6b8e251f49a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 1020KB

2026-08-10_90a09b49fe06cbe8783dd6b8e251f49a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 1db6c4a74cbf9b18c9d780904feebe75
SHA256 f81d5fb22ddf885ef598d9d1bb9eff0c3667843352ba549cc06902a1cfcf1f74
MD5 90a09b49fe06cbe8783dd6b8e251f49a
SHA1 c03c5ebba5700d25215764946b456698476229ac
SHA512 23d1d7257b33a84ef0dc0d68c8357be36ccd05a23db600d71cfb3000b42de235cefaf24b5ba22b38d155e1ba79cbf4d36d6d14cd6a928d70a0615198811f3a38
SSDEEP 24576:1gjMAgjMkVigjULk70Trc7m20zWmQFHDPo/x9g7ZLp:ujM5jMCLjULkQTAKLzJ4HDA/Ql9
TLSH
T1B825AE13B643941AE8154070DD3A8B6C1F393FB65173A54777D4BBAEA532383B0623AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarSub _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaFreeVarList __vbaPut3 _adj_fdiv_m64 EVENT_SINK_Invoke __vbaRaiseEvent __vbaFreeObjList ord516 __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 __vbaI2Abs __vbaResume __vbaStrCat __vbaLsetFixstr ord660 __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryVar ord666 Zombie_GetTypeInfo __vbaAryDestruct __vbaLateMemSt __vbaExitProc __vbaBoolStr ord595 __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad __vbaStrFixstr __vbaBoolVarNull __vbaRefVarAry __vbaVarTstLt _CIsin ord631 ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaGet3 __vbaStrCmp __vbaVarTstEq ord561 __vbaObjVar __vbaI2I4 DllFunctionCall __vbaRedimPreserve _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 __vbaUI1I2 _CIsqrt __vbaObjIs EVENT_SINK_QueryInterface ord710 __vbaExceptHandler ord711 __vbaStrToUnicode ord712 ord606 _adj_fprem _adj_fdivr_m64 ord607 ord714 __vbaVarDiv __vbaI2Str ord608 ord716 __vbaFPException ord319 __vbaUbound __vbaStrVarVal __vbaVarCat ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf ord648 __vbaInStr __vbaR8Str ord570 __vbaNew2 __vbaCyMulI2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord681 __vbaI4Str __vbaFreeStrList _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord578 ord100 ord579 __vbaVarTstNe __vbaI4Var ord610 __vbaLateMemCall __vbaAryLock __vbaVarAdd ord320 __vbaStrToAnsi ord612 __vbaVarDup ord321 ord616 __vbaVarCopy __vbaFpI4 __vbaVarTstGe ord617 __vbaLateMemCallLd _CIatan __vbaUI1Str ord618 __vbaAryCopy __vbaStrMove __vbaCastObj ord619 _allmul __vbaVarLateMemCallSt _CItan __vbaAryUnlock _CIexp __vbaMidStmtBstr __vbaFreeObj __vbaFreeStr

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_90a09b49fe06cbe8783dd6b8e251f49a_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

msvbvm60

generic