2026-08-14_0a5bad8ee8fd1d679cdf26970a9c7939_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-08-14_0a5bad8ee8fd1d679cdf26970a9c7939_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 1.1MB
Sample260815-aq5fcsvgka
SHA256 41efc164e0c400dfe663ecaf3d2de596e30672923cc19a60a8c388088644c71f
MD5 0a5bad8ee8fd1d679cdf26970a9c7939
SHA1 086048e924ac0afc5c0280599a62ff6ab3cc8571
SHA512 02b2f5f0d21212ff3979b4cfa60bb4e1a6086a52adf9ae6a5a29cc3a2a16968216360c46f3edca5bb3d17fd6ef9dd4572ca91b79183291a48fc8f04b394306c3
SSDEEP 24576:Ik70zrcugBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJo:IkQzA3IwMtuvMDVPG4JdXeR4aT6LQ+D
TLSH
T14B4523157180D3B3C5F7013189D1CB746A2675B20F76A5EFB6AC6BA62F202F0B7261C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_0a5bad8ee8fd1d679cdf26970a9c7939_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-14_0a5bad8ee8fd1d679cdf26970a9c7939_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 1.1MB

2026-08-14_0a5bad8ee8fd1d679cdf26970a9c7939_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH bf5a4aa99e5b160f8521cadd6bfe73b8
SHA256 41efc164e0c400dfe663ecaf3d2de596e30672923cc19a60a8c388088644c71f
MD5 0a5bad8ee8fd1d679cdf26970a9c7939
SHA1 086048e924ac0afc5c0280599a62ff6ab3cc8571
SHA512 02b2f5f0d21212ff3979b4cfa60bb4e1a6086a52adf9ae6a5a29cc3a2a16968216360c46f3edca5bb3d17fd6ef9dd4572ca91b79183291a48fc8f04b394306c3
SSDEEP 24576:Ik70zrcugBukmO0ZthkvMjHVOKG4s0T+gLaEXeR4aiO/64Rpuzs+KJo:IkQzA3IwMtuvMDVPG4JdXeR4aT6LQ+D
TLSH
T14B4523157180D3B3C5F7013189D1CB746A2675B20F76A5EFB6AC6BA62F202F0B7261C9
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

52527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

RaiseException GetLastError MultiByteToWideChar lstrlenA InterlockedDecrement GetProcAddress LoadLibraryA FreeResource SizeofResource LockResource LoadResource FindResourceA GetModuleHandleA Module32Next CloseHandle Module32First CreateToolhelp32Snapshot GetCurrentProcessId SetEndOfFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA HeapFree GetProcessHeap HeapAlloc GetCommandLineA HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc HeapSize TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA WideCharToMultiByte GetConsoleCP GetConsoleMode ReadFile TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId FlushFileBuffers SetFilePointer SetHandleCount GetFileType GetStartupInfoA RtlUnwind FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage CompareStringA CompareStringW SetEnvironmentVariableA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA

ole32

OleInitialize

oleaut32

SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy SafeArrayCreateVector VariantClear VariantInit SysFreeString SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_0a5bad8ee8fd1d679cdf26970a9c7939_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

ole32

oleaut32

generic