2026-09-16_828da7ce5e24260a293a025e43e71e8d_amadey_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-09-16_828da7ce5e24260a293a025e43e71e8d_amadey_elex_rhadamanthys_smoke-loader_stop
Size 212KB
Sample260916-ymtfpafj8w
SHA256 87947b65ffc92247483962c783123a4903b9ddb27dccb63ac30359d94d21e281
MD5 828da7ce5e24260a293a025e43e71e8d
SHA1 098cf34ed394ff56f6eb96da4bdf43bf989f634d
SHA512 d6bf34a228259d9bec5bf42d4f65ebf6d17750503e882e8d3c7509cb961f8a63f1602be4fde8909ffc5f2ec1cbbbde0a0bb594b4a0d2881d2e39e6eda3602c31
SSDEEP 3072:5fSR6mROam0pUAQ1zEalKDgxR2btuciJrKF0wtCc3WHXgO3xb3WHXgO3xJH:5KR9bUApa92bt6ZuGmiXgOhziXgOhZ
TLSH
T176247C2139C2C4BFE4664532C896D9B867B9EC23BA77894377E53B4E2E760C1C316391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_828da7ce5e24260a293a025e43e71e8d_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-16_828da7ce5e24260a293a025e43e71e8d_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 212KB

2026-09-16_828da7ce5e24260a293a025e43e71e8d_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 9d9c06172c6315371132e7c4972f320b
SHA256 87947b65ffc92247483962c783123a4903b9ddb27dccb63ac30359d94d21e281
MD5 828da7ce5e24260a293a025e43e71e8d
SHA1 098cf34ed394ff56f6eb96da4bdf43bf989f634d
SHA512 d6bf34a228259d9bec5bf42d4f65ebf6d17750503e882e8d3c7509cb961f8a63f1602be4fde8909ffc5f2ec1cbbbde0a0bb594b4a0d2881d2e39e6eda3602c31
SSDEEP 3072:5fSR6mROam0pUAQ1zEalKDgxR2btuciJrKF0wtCc3WHXgO3xb3WHXgO3xJH:5KR9bUApa92bt6ZuGmiXgOhziXgOhZ
TLSH
T176247C2139C2C4BFE4664532C896D9B867B9EC23BA77894377E53B4E2E760C1C316391
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

64781

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

w:\ITripoli\Self Extract Utility\Src_2005\Executables\Release\SelfExtractorTemplEx.pdb

comctl32

ImageList_GetIcon

kernel32

WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceA FindResourceExA InterlockedExchange MultiByteToWideChar GetLastError CompareStringA CompareStringW lstrlenA FlushInstructionCache GetCurrentProcess RaiseException EnterCriticalSection LeaveCriticalSection GetVersionExA GetCurrentThreadId FreeLibrary LoadLibraryA SetLastError LocalFree GetExitCodeProcess WaitForSingleObject CreateProcessA CloseHandle GetVolumeInformationA HeapFree HeapAlloc GetProcessHeap ExpandEnvironmentStringsA GetProcAddress GetModuleHandleA CreateFileA ReadFile WriteFile SetFilePointer LocalFileTimeToFileTime SystemTimeToFileTime CreateDirectoryA GetCurrentDirectoryA GetModuleFileNameA GetComputerNameA SetFileTime RemoveDirectoryA FindClose FindNextFileA DeleteFileA FindFirstFileA GetDriveTypeA GetTickCount SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStringTypeW GetStringTypeA GetSystemTimeAsFileTime SetEnvironmentVariableA GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetTimeZoneInformation Sleep GetFileType LocalAlloc GetACP GetLocaleInfoA GetThreadLocale HeapDestroy HeapReAlloc HeapSize InitializeCriticalSection DeleteCriticalSection InterlockedCompareExchange IsProcessorFeaturePresent VirtualFree VirtualAlloc RtlUnwind ExitProcess GetCommandLineA GetStartupInfoA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement HeapCreate GetStdHandle GetCPInfo GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetConsoleCP GetConsoleMode FlushFileBuffers SetHandleCount

user32

MessageBoxA CreateWindowExA LookupIconIdFromDirectoryEx RegisterClassExA DefWindowProcA CallWindowProcA GetWindowLongA DestroyIcon DestroyWindow LoadCursorA GetClassInfoExA IsWindow SetWindowLongA CreateIconFromResourceEx UnregisterClassA

shell32

SHGetFileInfoA Shell_NotifyIconA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_828da7ce5e24260a293a025e43e71e8d_amadey_elex_rhadamanthys_smoke-loader_stop

comctl32

kernel32

user32

shell32

generic