2026-09-29_dde0ae839cfad2dbaf1cbb89642f83ce_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-09-29_dde0ae839cfad2dbaf1cbb89642f83ce_amadey_elex_rhadamanthys_smoke-loader_stealc_stop
Size 455KB
Sample260929-slem9aaa92
SHA256 d893adefef1bc23a6aa9e0c10993d05f24fdf25f35a3b8e355470bb4e4a535e5
MD5 dde0ae839cfad2dbaf1cbb89642f83ce
SHA1 2067bb1044e617016cf6b8e9a13d42802cf2b976
SHA512 6f66defb3a3b3e5b6667ea829d12d9ef63e2f7e8f89171d05733f3d21ebe0c953a6a6ab905c3a7a801141dbad350948a9e82fc753d43eca11f6d7d256a8e64d7
SSDEEP 12288:nGrMu3MX+M1FB0fqYxAZCpgznx40s96hne:EMuy3maIi69oe
TLSH
T16FA401D136E0E472CC9245B449B9C2E11EBAB8A2D465C58B77B42B7EFE312C17732315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_dde0ae839cfad2dbaf1cbb89642f83ce_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-29_dde0ae839cfad2dbaf1cbb89642f83ce_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 455KB

2026-09-29_dde0ae839cfad2dbaf1cbb89642f83ce_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 8291759aef0e46c8057b5d52bd12239f
SHA256 d893adefef1bc23a6aa9e0c10993d05f24fdf25f35a3b8e355470bb4e4a535e5
MD5 dde0ae839cfad2dbaf1cbb89642f83ce
SHA1 2067bb1044e617016cf6b8e9a13d42802cf2b976
SHA512 6f66defb3a3b3e5b6667ea829d12d9ef63e2f7e8f89171d05733f3d21ebe0c953a6a6ab905c3a7a801141dbad350948a9e82fc753d43eca11f6d7d256a8e64d7
SSDEEP 12288:nGrMu3MX+M1FB0fqYxAZCpgznx40s96hne:EMuy3maIi69oe
TLSH
T16FA401D136E0E472CC9245B449B9C2E11EBAB8A2D465C58B77B42B7EFE312C17732315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8436

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\wux\tozugu14\nif.pdb

kernel32

GetLocaleInfoA LoadResource ReadConsoleA InterlockedDecrement GetCurrentProcess GetEnvironmentStringsW GetUserDefaultLCID FindActCtxSectionStringA GetUserDefaultLangID QueryActCtxW InitializeCriticalSection ReadConsoleInputA GetSystemWindowsDirectoryA LeaveCriticalSection PulseEvent VerifyVersionInfoA WriteConsoleW GetModuleFileNameW ReleaseSemaphore GetConsoleOutputCP GetProcAddress PrepareTape OpenMutexA LocalAlloc GlobalGetAtomNameW WaitForMultipleObjects SetSystemTime GetModuleFileNameA GetModuleHandleA FindFirstVolumeA AddConsoleAliasA GetProfileSectionW GetCommandLineW HeapAlloc GetStartupInfoW DeleteCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind SetHandleCount GetFileType GetStartupInfoA SetFilePointer CloseHandle FreeEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount LoadLibraryA GetCPInfo GetACP GetOEMCP IsValidCodePage WideCharToMultiByte CreateFileA RaiseException SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA LCMapStringW SetEndOfFile GetProcessHeap ReadFile WriteConsoleA

user32

RealChildWindowFromPoint

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_dde0ae839cfad2dbaf1cbb89642f83ce_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

generic