2026-09-30_5e81b47aff27985e4207f97490ae513e_amadey_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-09-30_5e81b47aff27985e4207f97490ae513e_amadey_elex_rhadamanthys_smoke-loader_stop
Size 698KB
Sample260930-m7myvsdf85
SHA256 7aa72f371bf6a807e7e6c1cd6dfa9131ddc714ce30f6c1ebd36e07f80d2a5707
MD5 5e81b47aff27985e4207f97490ae513e
SHA1 8a215ffa7260c483ab2d7050880bbb66f150a599
SHA512 3787d2bfa087c5e3d4ee6a08ce9fd3458a99da08c731f08d4310525a3bc11ab8a6a1ddd84335af6fbdf14b361d7b8eafc4e4a897009a56f83490edc303c48ee9
SSDEEP 12288:XZ5xzr3CrLPFYBhvhAfI3TV2c3ZwfuCc7x817REAbJBTyAt8V8oqhKB:Xtz+rR0hvefyV2mZwH31REAnyC8U
TLSH
T1D5E4F120A6A1C835E7F712F4596993A8EB3E3DB05B6450CB22D637EE36346E49D30347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_5e81b47aff27985e4207f97490ae513e_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-30_5e81b47aff27985e4207f97490ae513e_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 698KB

2026-09-30_5e81b47aff27985e4207f97490ae513e_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH d0a8c3f24685503ba25bd76f34c13b9e
SHA256 7aa72f371bf6a807e7e6c1cd6dfa9131ddc714ce30f6c1ebd36e07f80d2a5707
MD5 5e81b47aff27985e4207f97490ae513e
SHA1 8a215ffa7260c483ab2d7050880bbb66f150a599
SHA512 3787d2bfa087c5e3d4ee6a08ce9fd3458a99da08c731f08d4310525a3bc11ab8a6a1ddd84335af6fbdf14b361d7b8eafc4e4a897009a56f83490edc303c48ee9
SSDEEP 12288:XZ5xzr3CrLPFYBhvhAfI3TV2c3ZwfuCc7x817REAbJBTyAt8V8oqhKB:Xtz+rR0hvefyV2mZwH31REAnyC8U
TLSH
T1D5E4F120A6A1C835E7F712F4596993A8EB3E3DB05B6450CB22D637EE36346E49D30347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6816

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dupisoloyitez\nezireyu37\xurig.pdb

kernel32

CallNamedPipeA SetWaitableTimer InterlockedIncrement GetQueuedCompletionStatus GetCommState InterlockedDecrement SetEvent FreeEnvironmentStringsA CreateNamedPipeW GetNumberFormatA ReadConsoleOutputA GetCommandLineA SetProcessPriorityBoost GetSystemTimes GetPrivateProfileIntA GetSystemDirectoryW GetConsoleAliasExesLengthW HeapCreate TerminateProcess FileTimeToSystemTime EnumResourceLanguagesA GetModuleFileNameW GetCompressedFileSizeA lstrlenW GetPrivateProfileIntW InterlockedExchange GetStartupInfoA GetCPInfoExW CopyFileExW GetLastError GetCurrentDirectoryW GetThreadLocale GetProcAddress SetStdHandle EnterCriticalSection LoadLibraryA OpenMutexA CreateSemaphoreW LocalAlloc WritePrivateProfileStringA GetProfileStringA HeapWalk FindAtomA GetModuleHandleA FindFirstChangeNotificationA FreeEnvironmentStringsW FindNextFileW WriteProfileStringW SetFileShortNameA TlsAlloc LocalSize FindAtomW DeleteFileW GetSystemTime LCMapStringW CopyFileExA GetVolumeInformationW FreeLibraryAndExitThread SetThreadContext MoveFileA GetStartupInfoW HeapValidate IsBadReadPtr RaiseException GetModuleHandleW Sleep ExitProcess TlsGetValue TlsSetValue GetCurrentThreadId TlsFree SetLastError DeleteCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter SetHandleCount GetStdHandle GetFileType GetCurrentProcess IsDebuggerPresent QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW GetCommandLineW HeapDestroy HeapFree VirtualFree GetModuleFileNameA WriteFile HeapAlloc HeapSize HeapReAlloc VirtualAlloc GetACP GetOEMCP GetCPInfo IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode MultiByteToWideChar LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA FlushFileBuffers WriteConsoleA GetConsoleOutputCP CloseHandle CreateFileA

advapi32

InitiateSystemShutdownA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_5e81b47aff27985e4207f97490ae513e_amadey_elex_rhadamanthys_smoke-loader_stop

kernel32

advapi32

generic