2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop
Size 3.0MB
Sample260928-slxttsxarc
SHA256 6bf1b78cfdf8cb57e4a8c9af4d9384b334988abe488c6b4bd26e1f1891efa511
MD5 66f394518787d0486fb112c21f4dec63
SHA1 84be56cb799ca4434747f76596801db74d6b09f9
SHA512 ee76cae0d9f8f358e0caf4c3e8625eaf363333b492b15e9fda0ae4c9b2066b85322ba5e0819e6ac7f4a227eeef291ee5dd77701883167c1b2d3ffb33996e0945
SSDEEP 49152:hdF7BYljA9n/TDbXNKd7JIsVihMadGxf+CA9n/TDbXNKd:hdF7/fb9s77WW6fb9s
TLSH
T102E523003BE0C836D6A325368DB9DB18996ABD215F2193CB67C4362E9F316D3D93524F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 3.0MB

2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 4e347d7c037e59679c1f4837993702ae
SHA256 6bf1b78cfdf8cb57e4a8c9af4d9384b334988abe488c6b4bd26e1f1891efa511
MD5 66f394518787d0486fb112c21f4dec63
SHA1 84be56cb799ca4434747f76596801db74d6b09f9
SHA512 ee76cae0d9f8f358e0caf4c3e8625eaf363333b492b15e9fda0ae4c9b2066b85322ba5e0819e6ac7f4a227eeef291ee5dd77701883167c1b2d3ffb33996e0945
SSDEEP 49152:hdF7BYljA9n/TDbXNKd7JIsVihMadGxf+CA9n/TDbXNKd:hdF7/fb9s77WW6fb9s
TLSH
T102E523003BE0C836D6A325368DB9DB18996ABD215F2193CB67C4362E9F316D3D93524F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

93390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

n:\ARM\BuildResults\bin\Win32\Release\AcrobatUpdater.pdb

msi

ord70

kernel32

TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree InterlockedIncrement CompareStringW GetModuleHandleA GetVersionExA LoadLibraryA GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW GetCurrentThreadId GlobalFlags LeaveCriticalSection GetSystemTimeAsFileTime HeapFree HeapAlloc GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind RaiseException HeapReAlloc SetStdHandle GetFileType HeapSize Sleep ExitProcess GetTimeZoneInformation HeapCreate VirtualFree VirtualAlloc GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStartupInfoA QueryPerformanceCounter GetTickCount GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetCurrentDirectoryA GetDriveTypeA CreateFileA SetEnvironmentVariableA lstrlenA GetCurrentProcessId GetFileTime GetFileSizeEx FreeLibrary InterlockedDecrement GetModuleHandleW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW GlobalFree GlobalAlloc GlobalLock GlobalUnlock GetProcAddress GetModuleFileNameW GetFullPathNameW GetVolumeInformationW GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile LoadLibraryW WideCharToMultiByte LocalAlloc FindClose lstrlenW lstrcmpW GetFileAttributesW FindFirstFileW lstrcmpA CreateFileW CopyFileW CloseHandle SetLastError MultiByteToWideChar GetExitCodeProcess OpenProcess GetPrivateProfileStringW WaitForSingleObject CreateProcessW SetFileAttributesW LocalFree DeleteFileW LockResource MoveFileW GetLastError GetTempPathW FormatMessageW SizeofResource LoadResource FindResourceW CompareStringA

user32

SetWindowTextW ValidateRect RegisterWindowMessageW LoadIconW WinHelpW GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetFocus IsWindow DispatchMessageW GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos PeekMessageW MapWindowPoints SetMenuItemBitmaps GetKeyState SetMenu SetForegroundWindow GetClientRect PostMessageW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetDlgCtrlID DefWindowProcW CopyRect PtInRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowTextW GetWindowThreadProcessId SendMessageW GetParent GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow UnhookWindowsHookEx GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu CharUpperW GetSystemMetrics PostQuitMessage DestroyMenu GetForegroundWindow MessageBoxW CallWindowProcW

advapi32

RegOpenKeyExW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW

shell32

ShellExecuteW SHGetFolderPathW

shlwapi

PathStripToRootW PathFindFileNameW PathIsUNCW

crypt32

CryptDecodeObject CertGetNameStringW CertCloseStore CryptMsgGetParam CryptMsgClose CryptQueryObject CertFreeCertificateContext CertFindCertificateInStore

wintrust

WinVerifyTrust

oleacc

CreateStdAccessibleObject LresultFromObject

psapi

GetModuleBaseNameW EnumProcesses EnumProcessModules GetModuleFileNameExW

gdi32

RestoreDC SaveDC GetStockObject SetBkColor SetTextColor CreateBitmap DeleteDC SetMapMode GetClipBox SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx GetDeviceCaps RectVisible PtVisible DeleteObject OffsetViewportOrgEx

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

comdlg32

GetFileTitleW

oleaut32

VariantChangeType VariantClear VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_66f394518787d0486fb112c21f4dec63_amadey_elex_rhadamanthys_smoke-loader_stop

msi

kernel32

user32

advapi32

shell32

shlwapi

crypt32

wintrust

oleacc

psapi

gdi32

winspool.drv

comdlg32

oleaut32

generic