2026-08-31_cef4fb5948691dcda681477a37aea6a6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-31_cef4fb5948691dcda681477a37aea6a6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 12.8MB
Sample260831-rt744atemc
SHA256 bfdae27eb389ad0a9fe6c4b576f3272913c43cb50d0222e1789b37d8e78fbc7d
MD5 cef4fb5948691dcda681477a37aea6a6
SHA1 f538799b4af6be4b0691d2a11707d990493d89a3
SHA512 0dea3f912e605e0374b421452be071dfa4ec4e77f1e37fa078fc73093a1699013a10915f2927b03605cebcc0858d1129e35699d966b3df8a41e534646a4f5e8c
SSDEEP 3072:icp98ww14uzl+yxYFnplvcDkV951snWqbNDB5TMLTkjoiK5NYMXwCsIw3m:fcwnT8sDcYj51snjV5TWTjD/7sc
TLSH
T1D5D6645984AA0A4BCE1AF978754D096FCDCE109FB09F371C31E5F83AD162E11EC53A62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-31_cef4fb5948691dcda681477a37aea6a6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-08-31_cef4fb5948691dcda681477a37aea6a6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 12.8MB

2026-08-31_cef4fb5948691dcda681477a37aea6a6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 52d0e35c520458543d7ae579063fd12a
SHA256 bfdae27eb389ad0a9fe6c4b576f3272913c43cb50d0222e1789b37d8e78fbc7d
MD5 cef4fb5948691dcda681477a37aea6a6
SHA1 f538799b4af6be4b0691d2a11707d990493d89a3
SHA512 0dea3f912e605e0374b421452be071dfa4ec4e77f1e37fa078fc73093a1699013a10915f2927b03605cebcc0858d1129e35699d966b3df8a41e534646a4f5e8c
SSDEEP 3072:icp98ww14uzl+yxYFnplvcDkV951snWqbNDB5TMLTkjoiK5NYMXwCsIw3m:fcwnT8sDcYj51snjV5TWTjD/7sc
TLSH
T1D5D6645984AA0A4BCE1AF978754D096FCDCE109FB09F371C31E5F83AD162E11EC53A62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33026

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

BuildCommDCBAndTimeoutsA InterlockedIncrement MoveFileExW GetLogicalDriveStringsW GetSystemWindowsDirectoryW GetUserDefaultLCID FlushConsoleInputBuffer OpenSemaphoreA FreeEnvironmentStringsA MoveFileWithProgressA GetTickCount GenerateConsoleCtrlEvent GetConsoleAliasExesW WaitNamedPipeW EnumTimeFormatsA GetDateFormatA GetUserDefaultLangID GetCommandLineA GetDriveTypeA GlobalAlloc GetSystemDirectoryW LoadLibraryW GetConsoleMode ReadConsoleInputA _hread GetCalendarInfoW GetConsoleAliasExesLengthW DeleteVolumeMountPointW GetFileAttributesA GetTimeFormatW GetConsoleAliasW TerminateProcess CreateMailslotW GetPrivateProfileIntW GetStartupInfoA _llseek GetCurrentDirectoryW SetLastError ReadConsoleOutputCharacterA GetProcAddress OpenWaitableTimerA LoadLibraryA OpenMutexA InterlockedExchangeAdd GetFileType MoveFileA GetNumberFormatW SetCurrentDirectoryW GetProfileStringA GlobalGetAtomNameW AddAtomA OpenJobObjectW CreateIoCompletionPort GetModuleHandleA FreeEnvironmentStringsW FindNextFileW EnumDateFormatsW QueryPerformanceFrequency PeekConsoleInputA SetFileShortNameA EndUpdateResourceA LocalSize GetWindowsDirectoryW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DebugBreak ResetWriteWatch EnumSystemLocalesW DeleteFileA SetInformationJobObject SetProcessAffinityMask CreateMutexW GetHandleInformation GetComputerNameA InterlockedDecrement EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCommandLineW HeapSetInformation GetStartupInfoW RaiseException RtlUnwind WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent HeapCreate GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW SetFilePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetACP GetOEMCP IsValidCodePage GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW HeapReAlloc SetStdHandle GetConsoleCP FlushFileBuffers WriteConsoleW CreateFileW CloseHandle

gdi32

GetTextFaceW GetCharWidthA

advapi32

InitializeAcl

Name

.text

Size

140KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

77KB

Virtual Size

30.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UriSKJUM

Size

9KB

Virtual Size

8KB

Characteristics

Name

vWSIiikC

Size

1024B

Virtual Size

547B

Characteristics

Name

IcwGkfPD

Size

10KB

Virtual Size

10KB

Characteristics

Name

VskAFyvI

Size

512B

Virtual Size

185B

Characteristics

Name

nIpbdHZj

Size

5KB

Virtual Size

4KB

Characteristics

Name

syiXfrAV

Size

2KB

Virtual Size

1KB

Characteristics

Name

rhpEamJW

Size

10KB

Virtual Size

9KB

Characteristics

Name

pIKSjqHu

Size

2KB

Virtual Size

2KB

Characteristics

Name

FacoyHxq

Size

26KB

Virtual Size

25KB

Characteristics

Name

GpsaTgpE

Size

12.4MB

Virtual Size

587B

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-31_cef4fb5948691dcda681477a37aea6a6_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

kernel32

gdi32

advapi32

generic