2026-09-30_5a6b279557b5709f2514b40cca4e90e6_amadey_elex_karagany_rhadamanthys_smoke-loader

General

Target
2026-09-30_5a6b279557b5709f2514b40cca4e90e6_amadey_elex_karagany_rhadamanthys_smoke-loader
Size 605KB
Sample260930-nb2mtazw6k
SHA256 a9c3af0fd9d5f91d132822eb9fd7ac153ef0e15a12c12ab408f0b4144463c33d
MD5 5a6b279557b5709f2514b40cca4e90e6
SHA1 a2aba448e166008e3f7f97179f912769d3d8eafe
SHA512 f52d6446be549839783efddfd2a74c85e8583d8b32cd0d92d46ec7bff58f1073ba980e2f2a6b220a89d67b1aedfec60dbc9c0d5e3678ee9874103196e848a3ac
SSDEEP 12288:59OK4Dc1/OK99umGkPp5ZHiN4mvsZzOaRZK61t:wDc1/PjPc4CsZzOaO
TLSH
T1ECD4F120B390C034F6B752F959B683A4762CBDB16B7489CB66D506EA13B46F0DC3139B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_5a6b279557b5709f2514b40cca4e90e6_amadey_elex_karagany_rhadamanthys_smoke-loader

File Explorer

2026-09-30_5a6b279557b5709f2514b40cca4e90e6_amadey_elex_karagany_rhadamanthys_smoke-loader

.exe 605KB

2026-09-30_5a6b279557b5709f2514b40cca4e90e6_amadey_elex_karagany_rhadamanthys_smoke-loader

IMPHASH 658c49f2b142429657b3337ed8c9de9e
SHA256 a9c3af0fd9d5f91d132822eb9fd7ac153ef0e15a12c12ab408f0b4144463c33d
MD5 5a6b279557b5709f2514b40cca4e90e6
SHA1 a2aba448e166008e3f7f97179f912769d3d8eafe
SHA512 f52d6446be549839783efddfd2a74c85e8583d8b32cd0d92d46ec7bff58f1073ba980e2f2a6b220a89d67b1aedfec60dbc9c0d5e3678ee9874103196e848a3ac
SSDEEP 12288:59OK4Dc1/OK99umGkPp5ZHiN4mvsZzOaRZK61t:wDc1/PjPc4CsZzOaO
TLSH
T1ECD4F120B390C034F6B752F959B683A4762CBDB16B7489CB66D506EA13B46F0DC3139B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\merifiwo\fageligorafupu\vupige73_vul\kezukihok\won-26\hejeberog.pdb

kernel32

GetThreadContext SetLocalTime FindResourceExW InterlockedIncrement GetQueuedCompletionStatus InterlockedDecrement UnlockFile SetEvent FreeEnvironmentStringsA GetModuleHandleW CreateNamedPipeW GetConsoleAliasesLengthA SetCommState GetCommandLineA GetPrivateProfileIntA GetSystemDirectoryW LoadLibraryW GetConsoleAliasExesLengthW HeapDestroy CreateSemaphoreA GetBinaryTypeA TerminateProcess lstrlenW LCMapStringA GetPrivateProfileIntW InterlockedExchange GetStartupInfoA GetStdHandle FreeLibraryAndExitThread OpenMutexW GetLastError GetCurrentDirectoryW GetThreadLocale GetProcAddress EnterCriticalSection LoadLibraryA LocalAlloc WritePrivateProfileStringA GetNumberFormatW GetProfileStringA SetThreadIdealProcessor HeapWalk FindAtomA SetSystemTime GlobalWire GetModuleFileNameA FindFirstChangeNotificationA FindNextFileW WriteProfileStringW GetCPInfoExA SetFileShortNameA TlsAlloc EnumResourceLanguagesW UnregisterWaitEx CopyFileExA DeleteFileA GetVolumeInformationW LocalFileTimeToFileTime EncodePointer DecodePointer HeapSetInformation GetStartupInfoW LeaveCriticalSection SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW ExitProcess HeapValidate IsBadReadPtr QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate WriteFile SetFilePointer GetConsoleCP GetConsoleMode OutputDebugStringA WriteConsoleW OutputDebugStringW RtlUnwind GetACP GetOEMCP GetCPInfo IsValidCodePage HeapAlloc HeapReAlloc HeapSize HeapQueryInformation HeapFree MultiByteToWideChar IsProcessorFeaturePresent FlushFileBuffers SetStdHandle LCMapStringW GetStringTypeW CloseHandle CreateFileW RaiseException

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_5a6b279557b5709f2514b40cca4e90e6_amadey_elex_karagany_rhadamanthys_smoke-loader

kernel32

generic