2026-08-25_8592e920074d6c76f4cb3f1d71af585e_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

General

Target
2026-08-25_8592e920074d6c76f4cb3f1d71af585e_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee
Size 737KB
Sample260826-xkfalseh77
SHA256 d659d0189efff96c10fbf52cbecff74a63305ed5b576bccb06428a26a58dc256
MD5 8592e920074d6c76f4cb3f1d71af585e
SHA1 a79089d62ee23d0634d4d543a6a988a23d0cd59c
SHA512 737ebf66bf5fcde03f4d836f9b0702ea2309aa0ce6c12068d1738d6fcb9a3d3020be3dbea63eec308a564166b6cf8f70444200b422c7b9b803a671901064bcad
SSDEEP 12288:AkwAbGuYVie+0TZxWTXOvXjfaz4WxXbIUv0CN6Q8UIiTOaBR/qpgn0YuCNZpYgGX:AkAVL+MUVXInaBJC5wZpYIWzyw7
TLSH
T12EF4023431C4C072D153113586A5C7F08EBABC726362989F77E91ABAEF386A1D63436D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_8592e920074d6c76f4cb3f1d71af585e_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-08-25_8592e920074d6c76f4cb3f1d71af585e_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

.exe 737KB

2026-08-25_8592e920074d6c76f4cb3f1d71af585e_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH ba6e7d1028cd73d291b266f23866459e
SHA256 d659d0189efff96c10fbf52cbecff74a63305ed5b576bccb06428a26a58dc256
MD5 8592e920074d6c76f4cb3f1d71af585e
SHA1 a79089d62ee23d0634d4d543a6a988a23d0cd59c
SHA512 737ebf66bf5fcde03f4d836f9b0702ea2309aa0ce6c12068d1738d6fcb9a3d3020be3dbea63eec308a564166b6cf8f70444200b422c7b9b803a671901064bcad
SSDEEP 12288:AkwAbGuYVie+0TZxWTXOvXjfaz4WxXbIUv0CN6Q8UIiTOaBR/qpgn0YuCNZpYgGX:AkAVL+MUVXInaBJC5wZpYIWzyw7
TLSH
T12EF4023431C4C072D153113586A5C7F08EBABC726362989F77E91ABAEF386A1D63436D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

36058

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\b\HTE\QDART\QDART_MFG\BSP_Storage\QSaharaServer\Release\QSaharaServer.pdb

kernel32

CloseHandle SetCommTimeouts CreateFileA WriteFile ReadFile Sleep GetTickCount GetSystemInfo GetSystemTimeAsFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetLastError GetFileType FindClose GetDriveTypeA FindFirstFileExA GetFileAttributesA EnterCriticalSection LeaveCriticalSection GetProcAddress GetModuleHandleW ExitProcess DecodePointer SetFilePointer GetCommandLineA HeapSetInformation TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer IsProcessorFeaturePresent WideCharToMultiByte GetTimeZoneInformation SetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetStartupInfoW DeleteCriticalSection GetFullPathNameA HeapFree GetCurrentDirectoryW SetCurrentDirectoryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread GetConsoleCP GetConsoleMode SetEndOfFile HeapAlloc GetProcessHeap MultiByteToWideChar InterlockedExchange FatalAppExitA SetConsoleCtrlHandler FreeLibrary LoadLibraryW GetLocaleInfoW GetModuleFileNameW HeapSize HeapQueryInformation HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetCurrentProcessId RtlUnwind GetDriveTypeW LCMapStringW WriteConsoleW FlushFileBuffers GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CreateFileW CompareStringW SetEnvironmentVariableA CreateDirectoryA

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_8592e920074d6c76f4cb3f1d71af585e_elex_mafia_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

generic