2026-09-29_0a6fb9979149867f0faab0f81bb7fc11_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_0a6fb9979149867f0faab0f81bb7fc11_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_stop
Size 118KB
Sample260930-ghctpssajf
SHA256 ff573aecb852a4a565bfa90c47b9afa18888f6b38a2005ce711b0a40371fb7e8
MD5 0a6fb9979149867f0faab0f81bb7fc11
SHA1 7e3e2bf77ce7697dbf5ba820de394528ca2f4ca4
SHA512 bd0814d74a8111bf46cc18c007ef50456c9e27fd19108c15b31e9a37fc536f5897c9030c46858e61c07cdb985084e37bd0841088a1c2fa4c77deb60949970822
SSDEEP 1536:y8cRe9po9Me2JBAnTJTfla11vg7X2X2L+8JiYQM8ohdpr6v++wukgO7rG/:jr9nJBcflaEJia/6v++19Oo
TLSH
T1D4C37C0172D0C072E41624768555C7F14EBB78766C66AE8BBFCA4BF94F293D2E62830D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-09-29_0a6fb9979149867f0faab0f81bb7fc11_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_stop

File Explorer

2026-09-29_0a6fb9979149867f0faab0f81bb7fc11_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_stop

.exe 118KB

2026-09-29_0a6fb9979149867f0faab0f81bb7fc11_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_stop

IMPHASH d75b6be0189f939631a577bfc2b0952b
SHA256 ff573aecb852a4a565bfa90c47b9afa18888f6b38a2005ce711b0a40371fb7e8
MD5 0a6fb9979149867f0faab0f81bb7fc11
SHA1 7e3e2bf77ce7697dbf5ba820de394528ca2f4ca4
SHA512 bd0814d74a8111bf46cc18c007ef50456c9e27fd19108c15b31e9a37fc536f5897c9030c46858e61c07cdb985084e37bd0841088a1c2fa4c77deb60949970822
SSDEEP 1536:y8cRe9po9Me2JBAnTJTfla11vg7X2X2L+8JiYQM8ohdpr6v++wukgO7rG/:jr9nJBcflaEJia/6v++19Oo
TLSH
T1D4C37C0172D0C072E41624768555C7F14EBB78766C66AE8BBFCA4BF94F293D2E62830D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

cb:77:b5:2e:e3:55:f1:ef:02:3e:70:70:65:19:74:ab:ba:fa:86:51

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Cloudike Inc.,O=Cloudike Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Chains

Jul 17, 2025

CN=Cloudike Inc.,O=Cloudike Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Cloudike Inc.,O=Cloudike Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Cloudike Inc.,O=Cloudike Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Serial Number

0b:38:73:eb:7d:88:3e:b9:62:3a:c6:7d:d8:1a:b7:5e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 26, 2024 - Nov 25, 2025

Minor OS version

Major OS version

Entry point

6662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\build27\cpython\PCBuild\w9xpopen.pdb

kernel32

WaitForSingleObject GetExitCodeProcess CreateProcessA GetStdHandle GetFileType CloseHandle CompareStringW CompareStringA GetLastError HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree DeleteCriticalSection FatalAppExitA VirtualAlloc HeapReAlloc GetModuleHandleW Sleep GetProcAddress ExitProcess WriteFile GetModuleFileNameA SetHandleCount GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount RtlUnwind SetConsoleCtrlHandler FreeLibrary InterlockedExchange LoadLibraryA GetConsoleCP GetConsoleMode FlushFileBuffers GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetFilePointer SetStdHandle LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale CreateFileA GetTimeZoneInformation SetEnvironmentVariableA

user32

MessageBoxA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_0a6fb9979149867f0faab0f81bb7fc11_amadey_elex_rhadamanthys_sakula_smoke-loader_stealc_stop

kernel32

user32

generic