2026-08-23_f5306615b0368c33b2843b71494bba9b_amadey_elex_rhadamanthys_smoke-loader

General

Target
2026-08-23_f5306615b0368c33b2843b71494bba9b_amadey_elex_rhadamanthys_smoke-loader
Size 549KB
Sample260823-svsapsxgph
SHA256 7c22fdf06b34cb83e918d10fdad58504aabad98aaed7cd88ccb56ecd74f4d5e3
MD5 f5306615b0368c33b2843b71494bba9b
SHA1 5e36654c4ff11dc4d2ace7d53698fc722d22f282
SHA512 2081b58642f614659ffaa65215f9a6123443df3eaaf482efd72a41b92fef1a419fe337dc6cf703c01bfa26bcc61cce60db7ab7a2fa4a6408d1375d9eb8ea0ac5
SSDEEP 12288:USR2Bw13K0lJJ2aWPv8zoditFKd5gDlCCOFVOS8LC+Bo:72ODkqoMtFUgcLFTKta
TLSH
T140C412117592C876C6B211305739FBB25BBB74312639D5CB23902B3E4A703E09FAA7E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_f5306615b0368c33b2843b71494bba9b_amadey_elex_rhadamanthys_smoke-loader

File Explorer

2026-08-23_f5306615b0368c33b2843b71494bba9b_amadey_elex_rhadamanthys_smoke-loader

.exe 549KB

2026-08-23_f5306615b0368c33b2843b71494bba9b_amadey_elex_rhadamanthys_smoke-loader

IMPHASH 15e3257ae161a0641bdbe672f2a488ac
SHA256 7c22fdf06b34cb83e918d10fdad58504aabad98aaed7cd88ccb56ecd74f4d5e3
MD5 f5306615b0368c33b2843b71494bba9b
SHA1 5e36654c4ff11dc4d2ace7d53698fc722d22f282
SHA512 2081b58642f614659ffaa65215f9a6123443df3eaaf482efd72a41b92fef1a419fe337dc6cf703c01bfa26bcc61cce60db7ab7a2fa4a6408d1375d9eb8ea0ac5
SSDEEP 12288:USR2Bw13K0lJJ2aWPv8zoditFKd5gDlCCOFVOS8LC+Bo:72ODkqoMtFUgcLFTKta
TLSH
T140C412117592C876C6B211305739FBB25BBB74312639D5CB23902B3E4A703E09FAA7E5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8725

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\rexazabagehey_gelake\god18\dacukediyu\romagaxezayoje7.pdb

kernel32

LoadResource HeapAlloc SetMailslotInfo SetEnvironmentVariableW GetEnvironmentStringsW SetConsoleScreenBufferSize SetEvent FlushConsoleInputBuffer GetTickCount TlsSetValue FindResourceExA GlobalAlloc LoadLibraryW InitAtomTable FindNextVolumeW GetModuleFileNameW CreateActCtxA BindIoCompletionCallback GetProcAddress VirtualAlloc BeginUpdateResourceW PrepareTape GetAtomNameA LoadLibraryA WriteConsoleA FindFirstChangeNotificationA GetProcessAffinityMask AddConsoleAliasA CreateFileW WriteConsoleW DecodePointer EncodePointer GetModuleHandleW ExitProcess GetCommandLineW HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent ReadFile UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind SetHandleCount GetStdHandle GetFileType DeleteCriticalSection GetLastError SetFilePointer TlsAlloc TlsGetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapFree CloseHandle WriteFile FreeEnvironmentStringsW HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime MultiByteToWideChar Sleep GetCPInfo GetACP GetOEMCP IsValidCodePage WideCharToMultiByte CreateFileA SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers HeapSize RaiseException HeapReAlloc LCMapStringW GetStringTypeW SetEndOfFile GetProcessHeap

user32

SetCursorPos

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_f5306615b0368c33b2843b71494bba9b_amadey_elex_rhadamanthys_smoke-loader

kernel32

user32

generic