2026-09-30_da7839378af62563dce3ae63f6a8b649_amadey_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-09-30_da7839378af62563dce3ae63f6a8b649_amadey_elex_rhadamanthys_smoke-loader_stop
Size 531KB
Sample260930-h9em2svs7p
SHA256 09affcddd39ecb4423b74815e6f1b4f31d78acddda4e754085052ae6cb5d8e56
MD5 da7839378af62563dce3ae63f6a8b649
SHA1 58492994959d7b0f154e92b240cad5758023af3f
SHA512 c38ced1d32db6526b47c0350fba3b32d1c15db62b74d781265980038e595f5ea986ed224ac6960b67c899b44338acdaed8e3c9c1a2e72a1706b334ecaa4a7618
SSDEEP 12288:PTAU1ZFE51LFMqIB7tbtC9IEH/tZLnXM96/28s:rAU1zUOqs72Ig/tZLXMc/
TLSH
T113C412203AC1D0B1C01A4C7049545B706B3ABD3256A9A6837F741B7E6F312F1AE76F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_da7839378af62563dce3ae63f6a8b649_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-30_da7839378af62563dce3ae63f6a8b649_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 531KB

2026-09-30_da7839378af62563dce3ae63f6a8b649_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH eb3a4f4099156f85447a353ba89f6880
SHA256 09affcddd39ecb4423b74815e6f1b4f31d78acddda4e754085052ae6cb5d8e56
MD5 da7839378af62563dce3ae63f6a8b649
SHA1 58492994959d7b0f154e92b240cad5758023af3f
SHA512 c38ced1d32db6526b47c0350fba3b32d1c15db62b74d781265980038e595f5ea986ed224ac6960b67c899b44338acdaed8e3c9c1a2e72a1706b334ecaa4a7618
SSDEEP 12288:PTAU1ZFE51LFMqIB7tbtC9IEH/tZLnXM96/28s:rAU1zUOqs72Ig/tZLXMc/
TLSH
T113C412203AC1D0B1C01A4C7049545B706B3ABD3256A9A6837F741B7E6F312F1AE76F6E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8741

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\hag\hanejitoda\rexe\21\c.pdb

kernel32

InterlockedIncrement InterlockedDecrement GetCurrentProcess GetSystemWindowsDirectoryW GetUserDefaultLCID GetSystemDefaultLCID ReadConsoleW GetEnvironmentStrings GlobalAlloc GetLocaleInfoW LeaveCriticalSection FindNextVolumeW WriteConsoleW GetACP GetConsoleOutputCP VerifyVersionInfoW GetProcAddress EnterCriticalSection PrepareTape ResetEvent GetAtomNameA SetConsoleTitleW GetModuleHandleA Module32Next GetCurrentProcessId AddConsoleAliasA FindActCtxSectionStringW GetSystemTime GetProfileSectionW GetLocaleInfoA FindActCtxSectionGuid GetModuleFileNameW GetCommandLineW HeapAlloc GetCommandLineA GetStartupInfoA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId GetLastError DeleteCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA HeapSize RtlUnwind SetHandleCount GetFileType SetFilePointer CloseHandle FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode GetCPInfo GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount LoadLibraryA CreateFileA RaiseException SetStdHandle FlushFileBuffers WriteConsoleA MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetEndOfFile GetProcessHeap ReadFile

gdi32

GetCharWidthFloatA

advapi32

BackupEventLogA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_da7839378af62563dce3ae63f6a8b649_amadey_elex_rhadamanthys_smoke-loader_stop

kernel32

gdi32

advapi32

generic