2026-08-16_330718e07852255fd2729629085e02d8_amadey_elex_rhadamanthys_smoke-loader_stealc

General

Target
2026-08-16_330718e07852255fd2729629085e02d8_amadey_elex_rhadamanthys_smoke-loader_stealc
Size 29.6MB
Sample260816-r81cssdk6z
SHA256 409210e1e76bfacb1773b71dab24cf63cf23049ec5bc0d5ba94bdeb2055ca5d2
MD5 330718e07852255fd2729629085e02d8
SHA1 9231d6c021c0e9212846fd99397c33138a71cd4a
SHA512 da240fd23f464c2db4cf0fb3785ad821da613c4ff52f3ea04f5f35f1866b84460528267c8ed66bf22af9712459e04e4cbf5b5591e7ea14644f14a35897ce48df
SSDEEP 786432:DYFQCjcCuS6W8vemWDZL8FjYRt6zIDrXGSaBcxmzEG:DYFtuS6WDFg+RlGSCoMEG
TLSH
T19867338D6C76B832C8F759BBD7BD2183A491D7C3914B4CDB7BC502661E313160F99A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_330718e07852255fd2729629085e02d8_amadey_elex_rhadamanthys_smoke-loader_stealc

File Explorer

2026-08-16_330718e07852255fd2729629085e02d8_amadey_elex_rhadamanthys_smoke-loader_stealc

.exe 29.6MB

2026-08-16_330718e07852255fd2729629085e02d8_amadey_elex_rhadamanthys_smoke-loader_stealc

IMPHASH c9094bab9410a3b983b78bf5ff44c961
SHA256 409210e1e76bfacb1773b71dab24cf63cf23049ec5bc0d5ba94bdeb2055ca5d2
MD5 330718e07852255fd2729629085e02d8
SHA1 9231d6c021c0e9212846fd99397c33138a71cd4a
SHA512 da240fd23f464c2db4cf0fb3785ad821da613c4ff52f3ea04f5f35f1866b84460528267c8ed66bf22af9712459e04e4cbf5b5591e7ea14644f14a35897ce48df
SSDEEP 786432:DYFQCjcCuS6W8vemWDZL8FjYRt6zIDrXGSaBcxmzEG:DYFtuS6WDFg+RlGSCoMEG
TLSH
T19867338D6C76B832C8F759BBD7BD2183A491D7C3914B4CDB7BC502661E313160F99A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

43245

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

R:\TempView\Misc\Setup3\build\Release\HummerSetup.pdb

kernel32

SetFilePointer CreateDirectoryW WriteFile WideCharToMultiByte ReadFile CreateFileW GetLastError CloseHandle SetFileAttributesW FreeResource FindResourceW FreeLibrary LoadResource WaitForSingleObject GetModuleHandleW LoadLibraryW SizeofResource GetProcAddress LockResource GetFileAttributesW GetTempPathW GetLongPathNameW DeleteFileW GetFileSizeEx GetStringTypeW LCMapStringW SetStdHandle HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapCreate ExitProcess DecodePointer GetStdHandle GetModuleFileNameW EncodePointer SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection Sleep RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetConsoleCP GetConsoleMode RtlUnwind HeapReAlloc FlushFileBuffers GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize WriteConsoleW MultiByteToWideChar

user32

MessageBoxW

shell32

SHFileOperationW SHCreateDirectoryExW SHGetSpecialFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_330718e07852255fd2729629085e02d8_amadey_elex_rhadamanthys_smoke-loader_stealc

kernel32

user32

shell32

generic