2026-09-29_248e4945ba56e0dc613ff512fea72991_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-09-29_248e4945ba56e0dc613ff512fea72991_amadey_elex_rhadamanthys_smoke-loader_stealc_stop
Size 523KB
Sample260930-22pmtsvfrf
SHA256 517471b6c65e84cc120f692e6938a0eabe1e7e5b8e046bcf90a19d841dea6cc1
MD5 248e4945ba56e0dc613ff512fea72991
SHA1 2f9cd6251bf5585c7faf1d85c245e26c99b705b4
SHA512 12123c620ccfaa00c8edfdd56f7041203494378478c722926e49f65a87904f60291cb531998e9fda9bec6ae8e4f0b11c63e0233785414b06175b6d2dae0cfd7f
SSDEEP 12288:GZ2A9cXkM1gLQDl3IUN7Atiw0U0v9XywoXwgXp:c9cyLIl4XtiNU0zmZ
TLSH
T141B412263590C636C49221719D358EA16ABDFD219621C0CF73A53B2F2E602E15F7B36F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_248e4945ba56e0dc613ff512fea72991_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-29_248e4945ba56e0dc613ff512fea72991_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 523KB

2026-09-29_248e4945ba56e0dc613ff512fea72991_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH a0a666636aca5f36444e237f86f70507
SHA256 517471b6c65e84cc120f692e6938a0eabe1e7e5b8e046bcf90a19d841dea6cc1
MD5 248e4945ba56e0dc613ff512fea72991
SHA1 2f9cd6251bf5585c7faf1d85c245e26c99b705b4
SHA512 12123c620ccfaa00c8edfdd56f7041203494378478c722926e49f65a87904f60291cb531998e9fda9bec6ae8e4f0b11c63e0233785414b06175b6d2dae0cfd7f
SSDEEP 12288:GZ2A9cXkM1gLQDl3IUN7Atiw0U0v9XywoXwgXp:c9cyLIl4XtiNU0zmZ
TLSH
T141B412263590C636C49221719D358EA16ABDFD219621C0CF73A53B2F2E602E15F7B36F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8740

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\tin-cuyacocimo\mifub.pdb

kernel32

GetLocaleInfoA LoadResource FindActCtxSectionGuid ReadConsoleA InterlockedDecrement GetCurrentProcess GetEnvironmentStringsW GetUserDefaultLCID WaitForSingleObject AddConsoleAliasW FindActCtxSectionStringA GetUserDefaultLangID InitializeCriticalSection ReadConsoleInputA GetSystemWindowsDirectoryA PulseEvent VerifyVersionInfoA WriteConsoleW GetModuleFileNameW ReleaseSemaphore GetConsoleOutputCP GetProcAddress EnterCriticalSection PrepareTape OpenMutexA LocalAlloc GlobalGetAtomNameW WaitForMultipleObjects SetSystemTime GetModuleFileNameA SetConsoleTitleW GetModuleHandleA FindFirstVolumeA GetProfileSectionW LeaveCriticalSection GetCommandLineW HeapAlloc GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError HeapSize RtlUnwind SetHandleCount GetFileType GetStartupInfoA SetFilePointer CloseHandle FreeEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount LoadLibraryA CreateFileA RaiseException SetStdHandle FlushFileBuffers WriteConsoleA MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetEndOfFile GetProcessHeap ReadFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_248e4945ba56e0dc613ff512fea72991_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

generic