2026-08-12_793bc81995d09634da7917a1b7471832_amadey_elex_rhadamanthys_smoke-loader

General

Target
2026-08-12_793bc81995d09634da7917a1b7471832_amadey_elex_rhadamanthys_smoke-loader
Size 148KB
Sample260812-h6d74syscw
SHA256 a44308a42ea570a6d615138ccc94b5db3e2c689636d012f332e7f4427ad83fb7
MD5 793bc81995d09634da7917a1b7471832
SHA1 eff4207bb0dbf6dcf9e37e595f2a15ca2bdb912e
SHA512 0bf352dc5be9afdebf4071343cf6230a3bb48d5c46b06ccbe70d92053d20a242d232d3d7726b7113d079b4df136f40b27912c9c4ee926fd14b88eb7b7f4fe9f6
SSDEEP 3072:cpeNfhNywTXiy6fHUvmOXdxE9zuble2F87jZqMN:XNf7yxRUOmdxEEVsv
TLSH
T1B6E38D62B04090B1D94A8577896DDE3055B2FDBD4FF1481F63E8734D2EB33E2562AA0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-12_793bc81995d09634da7917a1b7471832_amadey_elex_rhadamanthys_smoke-loader

File Explorer

2026-08-12_793bc81995d09634da7917a1b7471832_amadey_elex_rhadamanthys_smoke-loader

.exe 148KB

2026-08-12_793bc81995d09634da7917a1b7471832_amadey_elex_rhadamanthys_smoke-loader

IMPHASH 3bd3c8ab805e675e9ee8d991d6c37b33
SHA256 a44308a42ea570a6d615138ccc94b5db3e2c689636d012f332e7f4427ad83fb7
MD5 793bc81995d09634da7917a1b7471832
SHA1 eff4207bb0dbf6dcf9e37e595f2a15ca2bdb912e
SHA512 0bf352dc5be9afdebf4071343cf6230a3bb48d5c46b06ccbe70d92053d20a242d232d3d7726b7113d079b4df136f40b27912c9c4ee926fd14b88eb7b7f4fe9f6
SSDEEP 3072:cpeNfhNywTXiy6fHUvmOXdxE9zuble2F87jZqMN:XNf7yxRUOmdxEEVsv
TLSH
T1B6E38D62B04090B1D94A8577896DDE3055B2FDBD4FF1481F63E8734D2EB33E2562AA0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1a:f6:05:7b:09:43:6a:90:bb:02:85:72:25:5d:70:62:97:ff:b0:59

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=IBM UK Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=e-business Infrastructure Technologies,O=IBM UK Ltd,L=Hursley,ST=Hampshire,C=GB

Chains

Oct 30, 2008

CN=IBM UK Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=e-business Infrastructure Technologies,O=IBM UK Ltd,L=Hursley,ST=Hampshire,C=GB

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=IBM UK Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=e-business Infrastructure Technologies,O=IBM UK Ltd,L=Hursley,ST=Hampshire,C=GB

Serial Number

37:6a:a2:85:6c:a7:af:ff:b1:97:d1:60:ee:bf:8a:d9

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 3, 2006 - Aug 11, 2009

Minor OS version

0

Major OS version

4

Entry point

35507

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\cygwin\home\foreman\sandbox\deploy-bin\tmp\deploy\javaws\bin\javaws.pdb

kernel32

GetThreadLocale WideCharToMultiByte GlobalAlloc MultiByteToWideChar ReadFile CloseHandle WaitForSingleObject CreateProcessA SetHandleInformation CreatePipe CreateDirectoryA GetWindowsDirectoryA FindClose GetModuleFileNameA GetModuleHandleA GetVersionExA SetEnvironmentVariableW GetCurrentDirectoryA GetFullPathNameA GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime LCMapStringW LCMapStringA GetSystemTimeAsFileTime GetTickCount LoadLibraryA GetProcAddress FindFirstFileA FreeLibrary GetCurrentProcessId QueryPerformanceCounter GetTimeZoneInformation FlushFileBuffers HeapSize SetEnvironmentVariableA CompareStringW CompareStringA GetSystemInfo VirtualProtect InitializeCriticalSection GetOEMCP GetACP HeapFree HeapAlloc ExitProcess TerminateProcess GetCurrentProcess GetLastError DeleteFileA EnterCriticalSection LeaveCriticalSection GetFileType CreateFileA GetStartupInfoA GetCommandLineA TlsAlloc SetLastError GetCurrentThreadId TlsFree TlsSetValue TlsGetValue HeapDestroy HeapCreate VirtualFree DeleteCriticalSection VirtualAlloc HeapReAlloc GetStringTypeA GetStringTypeW WriteFile SetStdHandle SetHandleCount GetStdHandle GetFileAttributesA SetEndOfFile SetFilePointer RtlUnwind InterlockedExchange VirtualQuery UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetLocaleInfoA GetExitCodeProcess

user32

wsprintfA DefWindowProcA DispatchMessageA TranslateMessage GetMessageA SetTimer CreateWindowExA RegisterClassA LoadCursorA MessageBoxA

advapi32

RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegCloseKey

wsock32

listen getsockname accept recv bind socket ioctlsocket htons connect send WSAGetLastError WSAStartup closesocket WSAAsyncSelect ntohs

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_793bc81995d09634da7917a1b7471832_amadey_elex_rhadamanthys_smoke-loader

PE Signature issue

kernel32

user32

advapi32

wsock32

generic