2026-08-11_815d561a5a04ba3321073b6329548323_amadey_elex_rhadamanthys_smoke-loader

General

Target
2026-08-11_815d561a5a04ba3321073b6329548323_amadey_elex_rhadamanthys_smoke-loader
Size 772KB
Sample260811-qxtkfaee89
SHA256 40a0c8ebee13b931dd28e91021f584d34fc6657daff1c00cc19bf80ba490641b
MD5 815d561a5a04ba3321073b6329548323
SHA1 6b189955e842cdf1f6e001d4a592aefa0724ed54
SHA512 97f310ee4a21249e0fbc685c0879cc0f34cca864bc285a29815d3bbf3aea1a6b1c8d208fa678c268cad24a755cd94ee3b5aad004bd28c191c24d9a9cce4592a7
SSDEEP 12288:yGvZHjfAHHb+RS5pEh5JkHFZqYAfL+uURTLhKwe4P1BHGwFp2+fNb:BD26RSHEh5S/dLTFe4P1x1
TLSH
T160F40292B6D4C2B0C4A9573A05DFE397B236B495072495C3F7D02E7E69336E06B38293
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_815d561a5a04ba3321073b6329548323_amadey_elex_rhadamanthys_smoke-loader

File Explorer

2026-08-11_815d561a5a04ba3321073b6329548323_amadey_elex_rhadamanthys_smoke-loader

.exe 772KB

2026-08-11_815d561a5a04ba3321073b6329548323_amadey_elex_rhadamanthys_smoke-loader

IMPHASH 529b9d138a1558538cb29eacb3a5575f
SHA256 40a0c8ebee13b931dd28e91021f584d34fc6657daff1c00cc19bf80ba490641b
MD5 815d561a5a04ba3321073b6329548323
SHA1 6b189955e842cdf1f6e001d4a592aefa0724ed54
SHA512 97f310ee4a21249e0fbc685c0879cc0f34cca864bc285a29815d3bbf3aea1a6b1c8d208fa678c268cad24a755cd94ee3b5aad004bd28c191c24d9a9cce4592a7
SSDEEP 12288:yGvZHjfAHHb+RS5pEh5JkHFZqYAfL+uURTLhKwe4P1BHGwFp2+fNb:BD26RSHEh5S/dLTFe4P1x1
TLSH
T160F40292B6D4C2B0C4A9573A05DFE397B236B495072495C3F7D02E7E69336E06B38293
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

20315

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\prod.tally9-erp9a.STABLE\tally.licensetools\lockconverter\bin\release\lockconverter.pdb

advapi32

CloseServiceHandle QueryServiceStatus OpenServiceW ControlService DeleteService StartServiceW CreateServiceW OpenSCManagerW InitializeSecurityDescriptor SetSecurityDescriptorDacl RegQueryValueExA RegCloseKey GetUserNameA RegOpenKeyA

kernel32

GetCurrentThreadId Sleep LoadLibraryA IsValidLocale GetLastError GetModuleHandleA GetVersionExA HeapAlloc HeapFree ExitProcess TerminateProcess WriteFile GetStdHandle GetModuleFileNameA UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue HeapDestroy HeapCreate VirtualFree LeaveCriticalSection CreateThread VirtualAlloc HeapReAlloc LCMapStringA HeapSize ReadFile SetFilePointer GetStringTypeA InitializeCriticalSection GetACP GetOEMCP RtlUnwind InterlockedExchange VirtualQuery GetLocaleInfoA VirtualProtect GetSystemInfo GetUserDefaultLCID EnumSystemLocalesA SetStdHandle FlushFileBuffers CreateFileA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetTimeZoneInformation SetEndOfFile CompareStringA SetEnvironmentVariableA GetWindowsDirectoryA GetSystemDirectoryA ExitThread GetPrivateProfileStringA GetPrivateProfileIntA DeviceIoControl ResetEvent WaitForSingleObject GetExitCodeThread GetCurrentProcessId GetCurrentProcess CloseHandle FreeLibrary EnterCriticalSection ReleaseMutex OpenEventA SetEvent CreateEventA WaitForMultipleObjects CreateMutexA MapViewOfFile OpenFileMappingA CreateFileMappingA GetFileSize GetTempPathA UnmapViewOfFile FlushViewOfFile GlobalAlloc GlobalFree LocalFree lstrlenA GetVersion lstrcmpA LocalAlloc

user32

wsprintfA MessageBoxA GetSystemMetrics

wsock32

WSACleanup WSACancelBlockingCall closesocket getsockname bind WSAGetLastError getpeername recv send connect gethostname

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_815d561a5a04ba3321073b6329548323_amadey_elex_rhadamanthys_smoke-loader

advapi32

kernel32

user32

wsock32

generic