2026-09-21_2b1875b876ca1048176a8ce1326b1861_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

General

Target
2026-09-21_2b1875b876ca1048176a8ce1326b1861_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 139KB
Sample260922-rms2lass7p
SHA256 f50cc62c434298f3a6c800f1f3a85bcd2ce73a74667f19cb21286869a58043bb
MD5 2b1875b876ca1048176a8ce1326b1861
SHA1 29755f02e65a6f4d47dbbfe2e8e0226c689bf131
SHA512 e2cfc67ad7e0a8fb046690945f620cb89fb3f562a27d3bc0842c5b1f21cd9d1111f8adffe3db2c2b4fd27e61fbf1d85e07e440713cf528514b52a560a6a11062
SSDEEP 3072:GMgszSDoVD8ndAJRc4QIqjb+bNZEnJGyUotqlbOTBf9pAytW78:9PmcVQnd4chbc/cJGyUo8OTBlWA48
TLSH
T1B1D38D28B6D1C0B2C9BB253109A5D7B9167DF92107308AC7F7981F3A5EA13E05A753CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-21_2b1875b876ca1048176a8ce1326b1861_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

File Explorer

2026-09-21_2b1875b876ca1048176a8ce1326b1861_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

.exe 139KB

2026-09-21_2b1875b876ca1048176a8ce1326b1861_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

IMPHASH 5b89e198e7265bfbe32f18fe35c09ea9
SHA256 f50cc62c434298f3a6c800f1f3a85bcd2ce73a74667f19cb21286869a58043bb
MD5 2b1875b876ca1048176a8ce1326b1861
SHA1 29755f02e65a6f4d47dbbfe2e8e0226c689bf131
SHA512 e2cfc67ad7e0a8fb046690945f620cb89fb3f562a27d3bc0842c5b1f21cd9d1111f8adffe3db2c2b4fd27e61fbf1d85e07e440713cf528514b52a560a6a11062
SSDEEP 3072:GMgszSDoVD8ndAJRc4QIqjb+bNZEnJGyUotqlbOTBf9pAytW78:9PmcVQnd4chbc/cJGyUo8OTBlWA48
TLSH
T1B1D38D28B6D1C0B2C9BB253109A5D7B9167DF92107308AC7F7981F3A5EA13E05A753CE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

54292

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetOpenA InternetOpenUrlA HttpQueryInfoA InternetCloseHandle InternetReadFile

advapi32

CryptReleaseContext CryptAcquireContextW CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash

kernel32

LoadLibraryW SetStdHandle WriteConsoleW FlushFileBuffers IsProcessorFeaturePresent CloseHandle WriteFile CreateFileW GetFileAttributesW ReadFile GetFileSizeEx CreateDirectoryW MultiByteToWideChar WideCharToMultiByte GetLocalTime MoveFileExW DeleteFileW Sleep GetTickCount CreateProcessW GetModuleFileNameW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetProcAddress LoadLibraryA GetModuleHandleW GetTempFileNameW GetTempPathW SetUnhandledExceptionFilter WaitForSingleObject GetLastError CreateMutexW GetCommandLineA SetCurrentDirectoryW RaiseException RtlUnwind EncodePointer DecodePointer HeapAlloc HeapFree HeapSetInformation GetStartupInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize ExitProcess GetStdHandle HeapCreate GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection SetFilePointer GetConsoleCP GetConsoleMode LCMapStringW GetStringTypeW HeapReAlloc

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_2b1875b876ca1048176a8ce1326b1861_amadey_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee

wininet

advapi32

kernel32

generic