2026-09-30_7e2ce94600ecf0c8e73aa31b292fa601_amadey_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-09-30_7e2ce94600ecf0c8e73aa31b292fa601_amadey_elex_rhadamanthys_smoke-loader_stop
Size 527KB
Sample260930-l68y9syepc
SHA256 0915217f01052ac6240cf3656931da818b2dc984e5842c4cda668124dac93374
MD5 7e2ce94600ecf0c8e73aa31b292fa601
SHA1 a235d3e5c6cd8e8217b077ff605362a00353bcab
SHA512 1a9d648b535dbab5d96310c49646ce5c69d16fad94ecbb3a688d9548781d256364cc46db2c75a27364e3facdf63ef1dab1b19097e067b76898768d8ee3205928
SSDEEP 12288:SUy2s8EYLsvZlqVYUWtPuwopNgIIWlWxKet4:c2smLUOxNJpWxKA4
TLSH
T1A9B4D030E6A0C035E5B711FC89B683B8A93E7E716B34D1CF52912AEE56B46E49C30753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_7e2ce94600ecf0c8e73aa31b292fa601_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-30_7e2ce94600ecf0c8e73aa31b292fa601_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 527KB

2026-09-30_7e2ce94600ecf0c8e73aa31b292fa601_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 6abb333342201a93de1795b4b0940b40
SHA256 0915217f01052ac6240cf3656931da818b2dc984e5842c4cda668124dac93374
MD5 7e2ce94600ecf0c8e73aa31b292fa601
SHA1 a235d3e5c6cd8e8217b077ff605362a00353bcab
SHA512 1a9d648b535dbab5d96310c49646ce5c69d16fad94ecbb3a688d9548781d256364cc46db2c75a27364e3facdf63ef1dab1b19097e067b76898768d8ee3205928
SSDEEP 12288:SUy2s8EYLsvZlqVYUWtPuwopNgIIWlWxKet4:c2smLUOxNJpWxKA4
TLSH
T1A9B4D030E6A0C035E5B711FC89B683B8A93E7E716B34D1CF52912AEE56B46E49C30753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6800

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xudocuyoruk.pdb

kernel32

CopyFileExW GetConsoleAliasExesLengthA CallNamedPipeA GetQueuedCompletionStatus GetCommState InterlockedDecrement CancelWaitableTimer UnlockFile SetEvent FreeEnvironmentStringsA CreateNamedPipeW GetNumberFormatA ReadConsoleOutputA GetCommandLineA GetPrivateProfileIntA GetSystemDirectoryW HeapCreate TerminateProcess FileTimeToSystemTime GetModuleFileNameW lstrlenW WritePrivateProfileStringW GetPrivateProfileIntW InterlockedExchange GetStartupInfoA GetCPInfoExW FreeLibraryAndExitThread SetThreadContext GetThreadLocale GetProcAddress SetStdHandle EnterCriticalSection LoadLibraryA OpenMutexA CreateSemaphoreW LocalAlloc GetProfileStringA SetThreadIdealProcessor HeapWalk GlobalWire GetModuleHandleA FindFirstChangeNotificationA FreeEnvironmentStringsW FindNextFileW WriteProfileStringW GetCurrentDirectoryA SetFileShortNameA TlsAlloc FindAtomW EnumResourceLanguagesW DeleteFileW GetSystemTime LCMapStringW CopyFileExA GetVolumeInformationW GetLastError GetFileSize MoveFileA GetStartupInfoW HeapValidate IsBadReadPtr RaiseException GetModuleHandleW Sleep InterlockedIncrement ExitProcess TlsGetValue TlsSetValue GetCurrentThreadId TlsFree SetLastError DeleteCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter SetHandleCount GetStdHandle GetFileType GetCurrentProcess IsDebuggerPresent QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW GetCommandLineW HeapDestroy HeapFree VirtualFree GetModuleFileNameA WriteFile HeapAlloc HeapSize HeapReAlloc VirtualAlloc GetACP GetOEMCP GetCPInfo IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode MultiByteToWideChar LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA FlushFileBuffers WriteConsoleA GetConsoleOutputCP CloseHandle CreateFileA

advapi32

InitiateSystemShutdownA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_7e2ce94600ecf0c8e73aa31b292fa601_amadey_elex_rhadamanthys_smoke-loader_stop

kernel32

advapi32

generic