2026-09-30_6fb878de7d623b42a8e024e35c73e65d_amadey_elex_rhadamanthys_smoke-loader_stop

General

Target
2026-09-30_6fb878de7d623b42a8e024e35c73e65d_amadey_elex_rhadamanthys_smoke-loader_stop
Size 626KB
Sample260930-mlxk6szemd
SHA256 edac136d943bc5d32be8603acee880898f1835fc6a84677fbbbb18d9a0f8460a
MD5 6fb878de7d623b42a8e024e35c73e65d
SHA1 062a005c6187b789d3f7349c27e055a3c3ecf661
SHA512 c6da20a9c7f83c1c8c8dd9173314861eb4f086b443ae71112bedaa5fbcc9842efed3a7c4dfab9b0c091764e04fd5861cec924ee0d77343bf8f248c7abc69e7f4
SSDEEP 12288:BeO47hIK5GY5ePsCBnRdKhNl/UV+rGatrSu4WohCE5jNRY:ohIK5TC3dUl/UbIrSu48EH
TLSH
T14AD4E0207BE0C035E5F712F889BA9769AA3E79B19B3050CF62D516EA26343E4DC31357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_6fb878de7d623b42a8e024e35c73e65d_amadey_elex_rhadamanthys_smoke-loader_stop

File Explorer

2026-09-30_6fb878de7d623b42a8e024e35c73e65d_amadey_elex_rhadamanthys_smoke-loader_stop

.exe 626KB

2026-09-30_6fb878de7d623b42a8e024e35c73e65d_amadey_elex_rhadamanthys_smoke-loader_stop

IMPHASH 64db17fb74f0fc4cbe32aa2e57d24a0f
SHA256 edac136d943bc5d32be8603acee880898f1835fc6a84677fbbbb18d9a0f8460a
MD5 6fb878de7d623b42a8e024e35c73e65d
SHA1 062a005c6187b789d3f7349c27e055a3c3ecf661
SHA512 c6da20a9c7f83c1c8c8dd9173314861eb4f086b443ae71112bedaa5fbcc9842efed3a7c4dfab9b0c091764e04fd5861cec924ee0d77343bf8f248c7abc69e7f4
SSDEEP 12288:BeO47hIK5GY5ePsCBnRdKhNl/UV+rGatrSu4WohCE5jNRY:ohIK5TC3dUl/UbIrSu48EH
TLSH
T14AD4E0207BE0C035E5F712F889BA9769AA3E79B19B3050CF62D516EA26343E4DC31357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7360

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\bulijebikin-pukat\lemo.pdb

kernel32

CopyFileExW GetConsoleAliasExesLengthA CallNamedPipeA GetQueuedCompletionStatus GetCommState InterlockedDecrement CancelWaitableTimer UnlockFile SetEvent FreeEnvironmentStringsA CreateNamedPipeW GetNumberFormatA ReadConsoleOutputA GetCommandLineA GetPrivateProfileIntA GetSystemDirectoryW HeapCreate TerminateProcess FileTimeToSystemTime GetModuleFileNameW lstrlenW WritePrivateProfileStringW GetPrivateProfileIntW InterlockedExchange GetStartupInfoA GetCPInfoExW FreeLibraryAndExitThread SetThreadContext GetThreadLocale GetProcAddress SetStdHandle EnterCriticalSection LoadLibraryA OpenMutexA CreateSemaphoreW LocalAlloc GetProfileStringA SetThreadIdealProcessor HeapWalk FindAtomA GlobalWire GetModuleHandleA FindFirstChangeNotificationA FreeEnvironmentStringsW FindNextFileW WriteProfileStringW GetCurrentDirectoryA SetFileShortNameA TlsAlloc EnumResourceLanguagesW GetSystemTime LCMapStringW CopyFileExA DeleteFileA GetVolumeInformationW GetLastError GetFileSize MoveFileA GetStartupInfoW HeapValidate IsBadReadPtr RaiseException GetModuleHandleW Sleep InterlockedIncrement ExitProcess TlsGetValue TlsSetValue GetCurrentThreadId TlsFree SetLastError GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW GetCommandLineW SetHandleCount GetStdHandle GetFileType HeapDestroy HeapFree VirtualFree GetModuleFileNameA WriteFile HeapAlloc HeapSize HeapReAlloc VirtualAlloc GetACP GetOEMCP GetCPInfo IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW MultiByteToWideChar LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP CreateFileA CloseHandle FlushFileBuffers

advapi32

InitiateSystemShutdownA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_6fb878de7d623b42a8e024e35c73e65d_amadey_elex_rhadamanthys_smoke-loader_stop

kernel32

advapi32

generic