2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop
Size 1.5MB
Sample260820-hh8rtatzdv
SHA256 f857bc1c697fe9c596626501b72bef50a1f75ca540e4639ef3d305a796d809fd
MD5 ce65ba593bdf944851ca23df280ce24b
SHA1 1019f9b83bc7aa274d0d1ad78a89daf7b8e1256b
SHA512 e519aaf0d2d3d06b80bae2c3ab2921c7cec964154fa9ae219d6ceceef4ce68a09ed1019a9a34c73bd2fc07c58e64995886fc09a2c5b8bdc624c8b831d33628fe
SSDEEP 24576:aWbwS8k1lPFgXe4i7ojhsP5Lgrk1TWb4AN5:h8k/PQe30jaNf1TWbdz
TLSH
T14175E01076D08036E1B3257649BECB65966DBD702F1182CF67C03A2FAE71AD1DA3172B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop

File Explorer

2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop

.exe 1.5MB

2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop

IMPHASH d4d812a56b78d38330998cf86ac74da8
SHA256 f857bc1c697fe9c596626501b72bef50a1f75ca540e4639ef3d305a796d809fd
MD5 ce65ba593bdf944851ca23df280ce24b
SHA1 1019f9b83bc7aa274d0d1ad78a89daf7b8e1256b
SHA512 e519aaf0d2d3d06b80bae2c3ab2921c7cec964154fa9ae219d6ceceef4ce68a09ed1019a9a34c73bd2fc07c58e64995886fc09a2c5b8bdc624c8b831d33628fe
SSDEEP 24576:aWbwS8k1lPFgXe4i7ojhsP5Lgrk1TWb4AN5:h8k/PQe30jaNf1TWbdz
TLSH
T14175E01076D08036E1B3257649BECB65966DBD702F1182CF67C03A2FAE71AD1DA3172B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\CB\ARM_Sustaining\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb

psapi

EnumProcesses EnumProcessModules GetModuleFileNameExW GetModuleBaseNameW

msi

ord70

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile

kernel32

WriteFile SetFilePointer FlushFileBuffers LockFile UnlockFile SetEndOfFile GetFileSize DuplicateHandle GetVolumeInformationW GetFullPathNameW GetModuleFileNameW GetProcAddress GetModuleHandleW InterlockedDecrement FreeLibrary lstrlenA ReadFile GetCurrentProcessId LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree InterlockedIncrement CompareStringW GetFileSizeEx GetFileTime GlobalFlags GetCurrentThreadId GlobalAddAtomW GetModuleHandleA GetVersionExA LoadLibraryA GlobalDeleteAtom GlobalFindAtomW CompareStringA GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW HeapReAlloc RtlUnwind RaiseException SetStdHandle GetFileType HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage HeapCreate VirtualFree VirtualAlloc GetStdHandle GetModuleFileNameA LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA QueryPerformanceCounter GetTickCount GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA GetCurrentDirectoryA GetDriveTypeA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA LoadLibraryW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW GlobalFree GlobalAlloc GlobalLock GlobalUnlock WideCharToMultiByte DeleteFileW MoveFileW LocalAlloc FindClose lstrcmpW FindFirstFileW lstrcmpA SetFileAttributesW CreateFileW CopyFileW CreateThread LocalFree CloseHandle CreateToolhelp32Snapshot Process32NextW LockResource Process32FirstW GetLocalTime SetLastError GetLongPathNameW GetLastError GetTempPathW lstrlenW MultiByteToWideChar GetFileAttributesW GetExitCodeProcess GetVersionExW FormatMessageW SizeofResource Sleep OpenProcess GetPrivateProfileStringW GetProcessHeap GetCurrentThread WaitForSingleObject HeapFree GetCurrentProcess HeapAlloc CreateProcessW LoadResource FindResourceW

user32

EnableMenuItem ModifyMenuW LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps PostQuitMessage DestroyMenu DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect GetMenu CheckMenuItem SystemParametersInfoA IsIconic GetWindowPlacement GrayStringW DrawTextExW DrawTextW TabbedTextOutW SetWindowsHookExW CallNextHookEx DispatchMessageW GetKeyState PeekMessageW ValidateRect SetWindowPos SetWindowLongW IsWindow ClientToScreen GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowThreadProcessId SendMessageW GetParent MessageBoxW GetForegroundWindow SetWindowTextW GetDlgItem GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow GetWindowTextW RegisterWindowMessageW LoadIconW WinHelpW FindWindowW GetCapture GetClassLongW SetPropW GetPropW RemovePropW GetTopWindow GetSubMenu GetMenuItemCount UnhookWindowsHookEx CharUpperW GetSystemMetrics GetMenuState GetMenuItemID GetFocus

advapi32

GetSidLengthRequired CryptHashData ConvertSidToStringSidW CryptDestroyHash CryptCreateHash GetNamedSecurityInfoW SetNamedSecurityInfoW RegDeleteKeyW CryptReleaseContext CryptAcquireContextW CryptGetHashParam RegSetValueExW RegCloseKey CheckTokenMembership GetLengthSid InitializeSid RegOpenKeyExW IsValidSid RegEnumValueW RegDeleteValueW DuplicateTokenEx LookupAccountSidW RegQueryInfoKeyW DuplicateToken CreateProcessAsUserW RegQueryValueExW RegCreateKeyExW CopySid GetTokenInformation RegCreateKeyW OpenThreadToken GetSidSubAuthority OpenProcessToken

shell32

SHChangeNotify ShellExecuteW SHGetFolderPathW

ole32

CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize

shlwapi

PathIsUNCW PathFindFileNameW PathStripToRootW

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CryptDecodeObject CryptMsgClose CryptMsgGetParam

wintrust

WinVerifyTrust

oleacc

CreateStdAccessibleObject LresultFromObject

gdi32

GetStockObject CreateBitmap DeleteDC ScaleWindowExtEx SetBkColor RestoreDC SetMapMode GetClipBox SetTextColor SaveDC DeleteObject GetDeviceCaps ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible SetWindowExtEx

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

comdlg32

GetFileTitleW

oleaut32

VariantInit VariantClear VariantChangeType

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_ce65ba593bdf944851ca23df280ce24b_amadey_elex_rhadamanthys_stop

psapi

msi

userenv

kernel32

user32

advapi32

shell32

ole32

shlwapi

crypt32

wintrust

oleacc

gdi32

winspool.drv

comdlg32

oleaut32

generic