2026-09-24_61674a1d641129b79892238bbbeb205a_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_61674a1d641129b79892238bbbeb205a_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee
Size 150KB
Sample260925-klbmlacd77
SHA256 222a927a210cc7dbe1ec23cc1220e0cfc94bda1a9eae3a73461ff21da0fb2887
MD5 61674a1d641129b79892238bbbeb205a
SHA1 9375298cfc512f03ba7bb0ffcdec2c34b54288f8
SHA512 07318c5b0305e959074ced58f2c61bd33f22777a52a63b066db6ae109fe9e6eea27f5de7557320a7fc47d726553b601dd3d11c34fd3ecc35e0874a6e8129e417
SSDEEP 3072:g7b4tc9obWA+X0wrrQq4QCVj6sEsELeA/fy6:GUWA+X9T4QebE7/a
TLSH
T136E3AED037F18032E5E36A3029B5CAB11E7AB8726A35848F7358172E1E733D05AB5797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_61674a1d641129b79892238bbbeb205a_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

File Explorer

2026-09-24_61674a1d641129b79892238bbbeb205a_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

.exe 150KB

2026-09-24_61674a1d641129b79892238bbbeb205a_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

IMPHASH d8d57c6d7c1f3570e93e87f831cb3f7a
SHA256 222a927a210cc7dbe1ec23cc1220e0cfc94bda1a9eae3a73461ff21da0fb2887
MD5 61674a1d641129b79892238bbbeb205a
SHA1 9375298cfc512f03ba7bb0ffcdec2c34b54288f8
SHA512 07318c5b0305e959074ced58f2c61bd33f22777a52a63b066db6ae109fe9e6eea27f5de7557320a7fc47d726553b601dd3d11c34fd3ecc35e0874a6e8129e417
SSDEEP 3072:g7b4tc9obWA+X0wrrQq4QCVj6sEsELeA/fy6:GUWA+X9T4QebE7/a
TLSH
T136E3AED037F18032E5E36A3029B5CAB11E7AB8726A35848F7358172E1E733D05AB5797
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15537

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\kukoxuhuz-woz-lalumixa86\gevimetef78 hiy79.pdb

kernel32

GetDefaultCommConfigW GetEnvironmentStringsW WaitForSingleObject CreateHardLinkA EnumCalendarInfoExW GetConsoleAliasesA GetConsoleAliasesLengthA GetSystemTimeAsFileTime GetConsoleTitleA CancelDeviceWakeupRequest EnumResourceTypesA GetLocaleInfoW InitializeCriticalSectionAndSpinCount SizeofResource GetProcessHandleCount GetFileAttributesA HeapCompact LCMapStringA GetHandleInformation GetLastError GetProcAddress VirtualAlloc CopyFileA GetFirmwareEnvironmentVariableW GetAtomNameA LoadLibraryA LocalAlloc LockResource WaitForMultipleObjects EnumDateFormatsA FillConsoleOutputAttribute CloseHandle DeleteAtom GlobalAddAtomW CheckRemoteDebuggerPresent SetConsoleCursorPosition GetSystemDefaultLangID IsProcessorFeaturePresent CreateFileW GetStringTypeW HeapAlloc EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapFree EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType DeleteCriticalSection GetModuleHandleW ExitProcess WriteFile GetModuleFileNameW HeapCreate Sleep HeapSize SetFilePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement FreeEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind LoadLibraryW HeapReAlloc ReadFile SetStdHandle FlushFileBuffers RaiseException WriteConsoleW MultiByteToWideChar LCMapStringW

user32

SetCaretPos

advapi32

CloseEventLog

ole32

CoGetMalloc

winhttp

WinHttpOpen WinHttpQueryOption

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_61674a1d641129b79892238bbbeb205a_amadey_elex_rhadamanthys_smoke-loader_stealc_tofsee

kernel32

user32

advapi32

ole32

winhttp

generic