2026-09-30_629aa740b10bc138ae954ede0462f66d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

General

Target
2026-09-30_629aa740b10bc138ae954ede0462f66d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop
Size 456KB
Sample260930-m2ncfa1hjd
SHA256 f161b8bb1e0585be31af03c9d3ce7f30a805767db89d04518e02f0b66deb6129
MD5 629aa740b10bc138ae954ede0462f66d
SHA1 5e76784d97f2cfe2cafcf5930b39323c78172c5f
SHA512 443d778136bb87b1033711967a996dedf64487b4868e43cbfb99d17010be986f8ea071cbfbc1fcdfefc460ec2f06da87997af164ea46fa8b796bce33c861cbb8
SSDEEP 12288:dZTr7VigXvMQfPfEpLVDFMQZbQc1Q1wFrSfsiuXEsqJURcm:7VigXzoLB6UQvEeDuUhUWm
TLSH
T10AA4026135F0E432D9D646B48538C2A65EFABC215578C047B798773FAFE02D06A3B34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_629aa740b10bc138ae954ede0462f66d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

File Explorer

2026-09-30_629aa740b10bc138ae954ede0462f66d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

.exe 456KB

2026-09-30_629aa740b10bc138ae954ede0462f66d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

IMPHASH a0a666636aca5f36444e237f86f70507
SHA256 f161b8bb1e0585be31af03c9d3ce7f30a805767db89d04518e02f0b66deb6129
MD5 629aa740b10bc138ae954ede0462f66d
SHA1 5e76784d97f2cfe2cafcf5930b39323c78172c5f
SHA512 443d778136bb87b1033711967a996dedf64487b4868e43cbfb99d17010be986f8ea071cbfbc1fcdfefc460ec2f06da87997af164ea46fa8b796bce33c861cbb8
SSDEEP 12288:dZTr7VigXvMQfPfEpLVDFMQZbQc1Q1wFrSfsiuXEsqJURcm:7VigXzoLB6UQvEeDuUhUWm
TLSH
T10AA4026135F0E432D9D646B48538C2A65EFABC215578C047B798773FAFE02D06A3B34A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8740

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\sorededakodu-sovaduv\tekoju sumavinatotigu.pdb

kernel32

GetLocaleInfoA LoadResource FindActCtxSectionGuid ReadConsoleA InterlockedDecrement GetCurrentProcess GetEnvironmentStringsW GetUserDefaultLCID WaitForSingleObject AddConsoleAliasW FindActCtxSectionStringA GetUserDefaultLangID InitializeCriticalSection ReadConsoleInputA GetSystemWindowsDirectoryA PulseEvent VerifyVersionInfoA WriteConsoleW GetModuleFileNameW ReleaseSemaphore GetConsoleOutputCP GetProcAddress EnterCriticalSection PrepareTape OpenMutexA LocalAlloc GlobalGetAtomNameW WaitForMultipleObjects SetSystemTime GetModuleFileNameA SetConsoleTitleW GetModuleHandleA FindFirstVolumeA GetProfileSectionW LeaveCriticalSection GetCommandLineW HeapAlloc GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate GetModuleHandleW Sleep ExitProcess WriteFile GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError HeapSize RtlUnwind SetHandleCount GetFileType GetStartupInfoA SetFilePointer CloseHandle FreeEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount LoadLibraryA CreateFileA RaiseException SetStdHandle FlushFileBuffers WriteConsoleA MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetEndOfFile GetProcessHeap ReadFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_629aa740b10bc138ae954ede0462f66d_amadey_elex_rhadamanthys_smoke-loader_stealc_stop

kernel32

generic