2026-09-29_5b30623b02d1dac5402df62630f0edbe_amadey_elex_rhadamanthys_smoke-loader_stealc

General

Target
2026-09-29_5b30623b02d1dac5402df62630f0edbe_amadey_elex_rhadamanthys_smoke-loader_stealc
Size 13.8MB
Sample260930-ak232ssekb
SHA256 a1a68a05d64124151e1aad7bebf4c042a051f9e9ace813c613641f0b558befad
MD5 5b30623b02d1dac5402df62630f0edbe
SHA1 f99f4721119441501b27750c88d4d1cc792248a4
SHA512 9a949c186fd2445317b5401e1da4d9f34dd604abaf947420d42678014d41f007f40d820aa68e52412fb63249c6109a342ebea99a5d80c6aad0d75047c146cbc1
SSDEEP 3072:kurXX+PBiSWHn9SBwcA/Z80HN1TFEGP8HOfwjQ6bdFor3Yz+HKa13jjjjjjjjjjX:dXVSOn9SBKh/TFEGBfw9vo7FHKa
TLSH
T1D8E6EA617BF2A045F7FBCA3666314958AB37FC6BF96AC31F20448A5B1C21681CD46B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_5b30623b02d1dac5402df62630f0edbe_amadey_elex_rhadamanthys_smoke-loader_stealc

File Explorer

2026-09-29_5b30623b02d1dac5402df62630f0edbe_amadey_elex_rhadamanthys_smoke-loader_stealc

.exe 13.8MB

2026-09-29_5b30623b02d1dac5402df62630f0edbe_amadey_elex_rhadamanthys_smoke-loader_stealc

IMPHASH 51faff478dd493c9f1e431a2afd51589
SHA256 a1a68a05d64124151e1aad7bebf4c042a051f9e9ace813c613641f0b558befad
MD5 5b30623b02d1dac5402df62630f0edbe
SHA1 f99f4721119441501b27750c88d4d1cc792248a4
SHA512 9a949c186fd2445317b5401e1da4d9f34dd604abaf947420d42678014d41f007f40d820aa68e52412fb63249c6109a342ebea99a5d80c6aad0d75047c146cbc1
SSDEEP 3072:kurXX+PBiSWHn9SBwcA/Z80HN1TFEGP8HOfwjQ6bdFor3Yz+HKa13jjjjjjjjjjX:dXVSOn9SBKh/TFEGBfw9vo7FHKa
TLSH
T1D8E6EA617BF2A045F7FBCA3666314958AB37FC6BF96AC31F20448A5B1C21681CD46B13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

21057

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindFirstFileW MoveFileExA InterlockedDecrement SetDefaultCommConfigW GetEnvironmentStringsW SetConsoleScreenBufferSize SetVolumeMountPointW GetSystemDefaultLCID GetModuleHandleW GetCommConfig GetConsoleAliasesLengthA ReadConsoleW GetConsoleAliasExesW GetDriveTypeA GetEnvironmentStrings GlobalAlloc GetPrivateProfileIntA LoadLibraryW TerminateThread ReadConsoleInputA CopyFileW SetConsoleCP DeleteVolumeMountPointW EnumSystemCodePagesA LocalReAlloc GetACP GetVolumePathNameA CreateMailslotW SetInformationJobObject CreateJobObjectA GetNamedPipeHandleStateW GetStartupInfoA GetLastError GetProcessVersion LoadLibraryA GetFileType RemoveDirectoryW FindAtomA FindNextFileA EnumDateFormatsA GetModuleHandleA SetLocaleInfoW FreeEnvironmentStringsW FindNextFileW VirtualProtect PurgeComm GetCurrentDirectoryA FatalAppExitA GetShortPathNameW ReadConsoleInputW FindAtomW GetWindowsDirectoryW FindFirstVolumeW AddConsoleAliasA EnumSystemLocalesW CreateFileW CloseHandle GetPrivateProfileSectionNamesW GetComputerNameA DisconnectNamedPipe GetCommandLineW RaiseException WriteConsoleW WideCharToMultiByte MoveFileA HeapAlloc EncodePointer DecodePointer HeapReAlloc HeapSetInformation GetStartupInfoW GetCPInfo InterlockedIncrement GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess ExitProcess WriteFile GetStdHandle GetModuleFileNameW HeapCreate EnterCriticalSection LeaveCriticalSection Sleep HeapSize HeapFree SetFilePointer SetHandleCount InitializeCriticalSectionAndSpinCount DeleteCriticalSection QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar GetStringTypeW IsProcessorFeaturePresent RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile

user32

CharUpperW

gdi32

SelectPalette GetTextFaceW GetCharWidthA

shell32

DragFinish

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_5b30623b02d1dac5402df62630f0edbe_amadey_elex_rhadamanthys_smoke-loader_stealc

kernel32

user32

gdi32

shell32

generic