2026-08-13_9814de3c8f0f38cf95bc2d019508784c_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-08-13_9814de3c8f0f38cf95bc2d019508784c_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
Size 10.2MB
Sample260813-2c8dmsyzcv
SHA256 145d50a2758ad6bde70e2f622e37b14d2d7dd15e4951920e00f8259855d98622
MD5 9814de3c8f0f38cf95bc2d019508784c
SHA1 ac8d08abf4f888a032718287808017b4f63660ac
SHA512 6ca53c85928eb31c112ee4361ce27d2c639044bcc13172cce1d5bb299084c8e4dbe22d0255eb117018ed61de43e082ee58af3be5632ff4699f3464c9ace03089
SSDEEP 196608:uMVXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:uMVXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
TLSH
T1A0B65B60AAE5DD88F1A57730883A9FE4277EFD5668F0464A31903B4E7CB3280657172F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_9814de3c8f0f38cf95bc2d019508784c_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-08-13_9814de3c8f0f38cf95bc2d019508784c_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

.exe 10.2MB

2026-08-13_9814de3c8f0f38cf95bc2d019508784c_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH e031c0deb9fb37ff7a3516ed2f4ac195
SHA256 145d50a2758ad6bde70e2f622e37b14d2d7dd15e4951920e00f8259855d98622
MD5 9814de3c8f0f38cf95bc2d019508784c
SHA1 ac8d08abf4f888a032718287808017b4f63660ac
SHA512 6ca53c85928eb31c112ee4361ce27d2c639044bcc13172cce1d5bb299084c8e4dbe22d0255eb117018ed61de43e082ee58af3be5632ff4699f3464c9ace03089
SSDEEP 196608:uMVXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX:uMVXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
TLSH
T1A0B65B60AAE5DD88F1A57730883A9FE4277EFD5668F0464A31903B4E7CB3280657172F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

85916

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\cufumohewuy\vubipeves-yehudokayasi-puro\cuyabayiconaw\nas-x.pdb

kernel32

GetModuleFileNameA InterlockedIncrement GetLocaleInfoW InterlockedCompareExchange _hread SetWaitableTimer GetSystemDirectoryW CreateEventA ReadConsoleW VerifyVersionInfoA WaitNamedPipeW BuildCommDCBW GetConsoleAliasExesLengthW PeekConsoleInputW CreateFileA RegisterWaitForSingleObjectEx LoadLibraryW GetEnvironmentStrings VirtualAlloc GetFirmwareEnvironmentVariableA BeginUpdateResourceA WriteConsoleW DeleteFileA FillConsoleOutputCharacterA LocalAlloc GetProcAddress GetUserDefaultLCID FindFirstChangeNotificationA GetFileAttributesExW GetCalendarInfoW SetFileApisToOEM AreFileApisANSI GetCurrentDirectoryW SetConsoleTitleW GetBinaryTypeW FindNextFileA OpenJobObjectA HeapValidate _lclose FoldStringW GetComputerNameA TlsSetValue SetCalendarInfoA SetComputerNameA GetThreadLocale GetSystemDefaultLangID LoadLibraryA GetDiskFreeSpaceW FindResourceExA RtlUnwind GetCommandLineW HeapSetInformation GetStartupInfoW EncodePointer IsProcessorFeaturePresent GetLastError HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DecodePointer TerminateProcess GetCurrentProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId InterlockedDecrement ExitProcess CloseHandle WriteFile GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep WideCharToMultiByte RaiseException SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle FlushFileBuffers LCMapStringW MultiByteToWideChar GetStringTypeW HeapAlloc HeapReAlloc SetEndOfFile GetProcessHeap ReadFile HeapSize CreateFileW

gdi32

GetCharWidth32A

ole32

CoRegisterMallocSpy

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_9814de3c8f0f38cf95bc2d019508784c_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

gdi32

ole32

generic