2026-09-30_95f6d1f969504a17585f6f9577959dd2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-09-30_95f6d1f969504a17585f6f9577959dd2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop
Size 440KB
Sample260930-les4qstsbv
SHA256 5ecac78e41a276a3071309237f46aab8c98b70db040d668b00e77132f46e4938
MD5 95f6d1f969504a17585f6f9577959dd2
SHA1 6063a4103563a7f129dcccdd20b388ccfb030f56
SHA512 e847d9cec4dbadac7e34aed3d065cfd53e10404a3dc0f06cf867d3a2180f55f29c81cbb54c31a77566c39796e3365d6e7043a5b13f0eb859aded4cf85df0a613
SSDEEP 12288:nXnzrLEREOmGJgbbgD2rOgXgzhAL+R1b6DjEEQ61NCwUX:njrLAEOzIbkkOhAQJY1mX
TLSH
T1F2A4011434A1E073C75B86B6887DC3A66A7EB8212669D18B77542B3E7E203C1573E372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_95f6d1f969504a17585f6f9577959dd2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-30_95f6d1f969504a17585f6f9577959dd2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 440KB

2026-09-30_95f6d1f969504a17585f6f9577959dd2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH 92f515ab3dd1c904aa1ddaf0eee2eeca
SHA256 5ecac78e41a276a3071309237f46aab8c98b70db040d668b00e77132f46e4938
MD5 95f6d1f969504a17585f6f9577959dd2
SHA1 6063a4103563a7f129dcccdd20b388ccfb030f56
SHA512 e847d9cec4dbadac7e34aed3d065cfd53e10404a3dc0f06cf867d3a2180f55f29c81cbb54c31a77566c39796e3365d6e7043a5b13f0eb859aded4cf85df0a613
SSDEEP 12288:nXnzrLEREOmGJgbbgD2rOgXgzhAL+R1b6DjEEQ61NCwUX:njrLAEOzIbkkOhAQJY1mX
TLSH
T1F2A4011434A1E073C75B86B6887DC3A66A7EB8212669D18B77542B3E7E203C1573E372
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8935

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xis94-xaxiwug.pdb

kernel32

GetLocaleInfoA LoadResource InterlockedIncrement ReadConsoleA GetSystemWindowsDirectoryW GetEnvironmentStringsW WaitForSingleObject FindActCtxSectionStringA GetUserDefaultLangID QueryActCtxW LeaveCriticalSection VerifyVersionInfoA WriteConsoleW ReleaseSemaphore GetProcAddress EnterCriticalSection DisableThreadLibraryCalls ResetEvent OpenMutexA LocalAlloc SetConsoleOutputCP GlobalGetAtomNameW WaitForMultipleObjects SetSystemTime GetModuleFileNameA GetModuleHandleA EraseTape FindFirstVolumeA GetCurrentProcessId AddConsoleAliasA GetModuleFileNameW GetCommandLineW GetLastError HeapReAlloc HeapAlloc GetModuleHandleW Sleep ExitProcess GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind HeapFree SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection SetFilePointer HeapCreate VirtualFree VirtualAlloc CloseHandle TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount FreeEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime CreateFileA RaiseException SetStdHandle WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize SetEndOfFile GetProcessHeap MultiByteToWideChar ReadFile WriteConsoleA GetConsoleOutputCP GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW

user32

RealChildWindowFromPoint

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_95f6d1f969504a17585f6f9577959dd2_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

user32

generic